Windows Update Configuration

Windows Update is a Microsoft service that provides updates for the Windows operating system and other Microsoft software. Its primary purpose is to deliver security patches, bug fixes, feature updates, and driver updates to keep systems secure and stable. Without regular updates, Windows systems become vulnerable to malware, exploits, and system instability. The 220-1102 exam expects you to know how to configure update settings, manage update types, and troubleshoot update failures.

Windows Update operates through a client-server model. The Windows Update client (wuauclt.exe or its modern replacement, the Update Orchestrator) runs as a service on the local machine. It communicates with Microsoft's update servers (or a local WSUS server in enterprise environments) over HTTPS (port 443). The process follows these steps:

- Update Types: - Security Updates: Critical patches for security vulnerabilities. Released monthly on Patch Tuesday (second Tuesday of the month). - Critical Updates: Fixes for non-security bugs that are important for stability. - Feature Updates: Major OS upgrades (e.g., version 22H2 to 23H2). Released twice a year (or once for LTSC). - Driver Updates: Updates for hardware drivers from Microsoft's catalog. - Definition Updates: Updates for Windows Defender antimalware signatures. - Update Rollups: Cumulative sets of updates (e.g., Monthly Rollup for Windows 7). - Optional Updates: Non-critical updates, including feature updates deferred for testing.

- Important Timers: - Active Hours: Default is 8:00 AM to 5:00 PM. Updates will not reboot during active hours. You can change this in Settings > Windows Update > Change active hours. - Update Deadline: For quality updates, the deadline is 7 days after detection by default for Windows 10/11 Pro. Feature updates have a 60-day deferral period. - Restart Notifications: Windows will notify the user 15 minutes before a forced reboot, then count down.

- Using PowerShell: - Get-WindowsUpdate (requires PSWindowsUpdate module) lists available updates. - Install-WindowsUpdate -AcceptAll installs all available updates. - Get-WUHistory shows installed update history.

- Using Command Prompt: - wuauclt /detectnow forces the Windows Update client to scan for updates (legacy, may not work on newer builds). - usoclient scan (Windows 10/11) triggers a scan for updates. - usoclient startscan – alternative command.

- Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update. - Key policies: - 'Configure Automatic Updates': Set to 2 (Notify for download and auto install), 3 (Auto download and notify), 4 (Auto download and schedule install), or 5 (Allow local admin to choose). - 'Specify intranet Microsoft update service location': Points to WSUS server. - 'Defer Windows Updates': Enable to defer feature updates for up to 365 days.

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

1. Open Windows Update Settings: Press Windows + I, then go to Update & Security (Windows 10) or Windows Update (Windows 11). 2. Check for Updates: Click 'Check for updates' to manually scan. 3. Change Active Hours: Click 'Change active hours' and set the time range when you don't want restarts. 4. View Update History: Click 'View update history' to see installed updates and their success/failure status. 5. Configure Advanced Options: Click 'Advanced options' to set: - Automatic Updates: Choose whether to download and install automatically or notify. - Defer Feature Updates: Toggle on/off (Pro and Enterprise only). - Defer Quality Updates: Toggle on/off (Pro and Enterprise only). - Delivery Optimization: Choose how updates are downloaded (from Microsoft, from local network, or from internet peers). 6. Pause Updates: In Windows 10/11 Pro, you can pause updates for up to 35 days. In Home, pause is limited to 7 days. 7. Restart Options: Set a specific restart time or use 'Restart now'.

1. Open Local Group Policy Editor: Press Windows + R, type gpedit.msc, and press Enter. 2. Navigate to Windows Update Policies: Go to Computer Configuration > Administrative Templates > Windows Components > Windows Update. 3. Configure Automatic Updates: Double-click 'Configure Automatic Updates'. - Select 'Enabled'. - Choose an option: 2 = Notify for download and auto install, 3 = Auto download and notify, 4 = Auto download and schedule install, 5 = Allow local admin to choose. - For option 4, set the schedule (e.g., every day at 3:00 AM). 4. Set WSUS Server: Double-click 'Specify intranet Microsoft update service location'. - Select 'Enabled'. - Enter the WSUS server URL (e.g., http://wsus-server:8530). 5. Defer Updates: Double-click 'Select when Preview Builds and Feature Updates are received'. - Enable and set the branch readiness level (e.g., Semi-Annual Channel) and deferral period (0-365 days). 6. Apply and Exit: Click OK, then close the editor.

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old

net start wuauserv
net start cryptSvc
net start bits
net start msiserver

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

$services = @("wuauserv","bits","cryptSvc","msiserver")
foreach ($service in $services) { Stop-Service -Name $service -Force }
Remove-Item -Path "$env:systemroot\SoftwareDistribution" -Recurse -Force
Remove-Item -Path "$env:systemroot\System32\catroot2" -Recurse -Force
foreach ($service in $services) { Start-Service -Name $service }

- Double-click 'Select when Preview Builds and Feature Updates are received'. - Enable the policy. - Choose 'Windows Insider Program' or 'Semi-Annual Channel' (or 'Semi-Annual Channel (Targeted)' for earlier access). 4. Set Deferral Period for Feature Updates:

- In the same policy, set the deferral period (0-365 days). - Example: 180 days delays feature updates by 6 months. 5. Set Deferral Period for Quality Updates:

- Double-click 'Select when Quality Updates are received'. - Enable and set deferral period (0-30 days). 6. Pause Updates:

- Double-click 'Manage preview builds and feature updates'. - Enable and set 'Pause updates' to 'Enabled' and choose 'Start date'. 7. Apply and Exit.

1. Open Settings: Go to Settings > Update & Security > Delivery Optimization (Windows 10) or Settings > Windows Update > Advanced options > Delivery Optimization (Windows 11). 2. Choose Update Source: - 'PCs on my local network' – only uses local peers. - 'PCs on my local network and PCs on the internet' – uses internet peers (default). 3. Advanced Options:

- Set absolute bandwidth (e.g., 50% of available bandwidth). - Set monthly upload data limit. 4. Using Group Policy:

- Navigate to Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization. - Enable 'Download mode' and set to: - 0 = HTTP only (no peering) - 1 = LAN peering - 2 = Group peering - 3 = Internet peering - 99 = Simple download mode (no peering) - Set 'Maximum upload bandwidth' in KB/s. 5. Using PowerShell:

Set-DeliveryOptimizationSetting -DownloadMode 1

1. Open Command Prompt as Administrator. 2. Run UsoClient commands: - usoclient scan – triggers a scan for updates. - usoclient startscan – same as scan. - usoclient download – downloads pending updates. - usoclient install – installs downloaded updates. - usoclient startinstall – same as install. 3. View Update History via Command Line:

wmic qfe list brief /format:table

- This displays installed updates with HotFixID, InstalledOn, and Description. 4. Using PowerShell to View History:

Get-HotFix | Format-Table -AutoSize

sc query wuauserv

- Look for STATE: RUNNING.

In a medium-sized company with 500 Windows 10 workstations, the IT team uses Windows Server Update Services (WSUS) to control update deployment. The WSUS server synchronizes with Microsoft Update once a day at 2:00 AM. Administrators approve updates after testing on a pilot group of 20 machines. Client machines are configured via Group Policy to point to the internal WSUS server (http://wsus.internal:8530). The policy also sets automatic update behavior to 'Auto download and notify' (option 3) so users are aware but IT controls installation timing. A common issue is that clients fail to report to WSUS if the policy is misconfigured or if the WSUS server URL is missing the port number. Performance is generally good, but during Patch Tuesday, the WSUS server may experience high load if all clients scan simultaneously. To mitigate, administrators stagger scan times using Group Policy.

A retail chain uses Windows 10 Home on point-of-sale (POS) terminals. These devices cannot defer updates via Group Policy, so updates are installed automatically. To avoid disruptions during business hours, the IT team sets active hours to cover the entire operating day (6:00 AM to 11:00 PM). However, Windows still forces a restart after 7 days for quality updates. This leads to occasional reboots during peak hours. The team mitigates by scheduling a weekly maintenance window and using the 'Restart notifications' policy to warn users. They also disable peer-to-peer delivery optimization via the Settings app to reduce network congestion. A common problem is that updates fail due to low disk space on the POS terminals (which have small SSDs). The IT team runs a script weekly to clean the SoftwareDistribution folder.

A government agency must comply with security mandates that require patches to be applied within 30 days. They use Windows 10 Enterprise and Windows Update for Business (WUfB) with Group Policy. They set feature update deferral to 120 days and quality update deferral to 0 days. They also configure two update rings: a 'Test' ring for IT staff (immediate updates) and a 'Production' ring (deferred 7 days). Delivery Optimization is set to LAN only to keep traffic internal. A challenge is that some legacy applications break after feature updates. The IT team uses the 'Select when Preview Builds and Feature Updates are received' policy to pause feature updates for up to 365 days if needed. They also use the Update Compliance add-in in Azure to monitor update status across the fleet. Misconfiguration of the deferral policy can lead to missing critical security patches, so they audit settings quarterly.