# Update ring

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/update-ring

## Quick definition

An Update ring is like a playlist for Windows updates that an IT admin creates. Devices in different rings get updates at different speeds, some fast for testing, others slow to avoid surprises. It helps roll out updates safely to thousands of computers without breaking everything at once.

## Simple meaning

Imagine you are in charge of updating the software on 500 computers in a hospital. If you push a brand new update to every computer at the exact same moment, there is a real risk that the update might cause a critical system, like the patient record database, to stop working. That would be a disaster. An Update ring is your solution. It lets you group computers into sets, or rings, and schedule updates in waves.

Think of it like launching a new flavor of ice cream. You do not send the new flavor to every store on day one. First, you test it in your own kitchen, that is the inner ring, usually IT staff and test devices. If it tastes good, you send it to a few select stores, that is the pilot ring, maybe a small department. If customers love it, you roll it out city-wide, the broad ring. Finally, after everyone is happy, you send it to all stores nationwide, the final ring. Each step builds confidence.

In the IT world, Update rings work exactly like that. You define groups of devices in a tool like Microsoft Intune or Windows Server Update Services (WSUS). Each group is assigned a ring. The first ring (Ring 1) gets updates immediately, often the day Microsoft releases them. Ring 2 gets updates after a few weeks. Ring 3 gets them after a month. This staggered approach means if an update causes a blue screen or breaks a driver, only a small number of machines are affected. IT can quickly pause or roll back the update before it reaches the rest of the organization. No chaos, no global outage, and no frantic phone calls to the help desk.

## Technical definition

An Update ring is a configuration object within Microsoft Endpoint Manager (Intune) or Group Policy that defines the policy settings for Windows Update for Business (WUfB). It controls how and when Windows 10 and Windows 11 devices receive feature updates (version upgrades like 22H2 to 23H2) and quality updates (monthly security patches). Technically, each ring is a collection of policies that includes deferral periods, update deadlines, and feature update target versions.

When you create an update ring in Intune, you specify key parameters. The Deferral period delays the receipt of updates for a set number of days after Microsoft releases them. For example, a ring might set a 30-day deferral for feature updates, meaning devices in that ring will not see the update available for download until 30 days after Microsoft publishes it. A second key setting is the Deadline, which forces the update to install by a certain date after it becomes available. You can set a deadline of 7 days, meaning once the update is offered, the device must install it within a week or it will automatically install during the next maintenance window.

Other critical settings include Update notification level, you can choose whether users see a simple notification or a full-screen reminder. You can also set Automatic update behavior, such as "Download and install at scheduled time" or "Auto install at maintenance time." Maintenance windows are often defined using a separate policy but are tightly linked to ring behavior.

From a protocol perspective, Update rings rely on the Windows Update client built into the operating system. The client communicates with the Microsoft Update servers (or a local WSUS server) to check for applicable updates. The client reads the ring policy from Intune or Group Policy, which tells it which update branch it belongs to (e.g., Semi-Annual Channel or General Availability Channel). The client then filters available updates based on the deferral and deadline policies. When a feature update is approved for a ring, the client downloads it using Background Intelligent Transfer Service (BITS) or Delivery Optimization (peer-to-peer sharing) to reduce bandwidth.

In a hybrid environment, Update rings can be combined with Windows Update for Business reports to monitor deployment progress. Administrators can see how many devices in each ring have successfully installed an update, which devices have failed, and which are pending restart. Microsoft recommends using at least three rings: a Test ring (few devices, immediate updates), a Pilot ring (5-10% of production devices, short deferral), and a Production ring (all remaining devices, longer deferral). Advanced setups may include a Critical ring for emergency security patches and a Staged ring for regulatory compliance.

For on-premises environments using WSUS, Update rings are implemented via Group Policy Objects (GPOs) applied to different Organizational Units (OUs). Each GPO specifies the target group for the update, and WSUS assigns approvals to each group separately. The concept is identical, but the implementation relies on Active Directory structure rather than cloud-based Intune enrollment.

## Real-life example

Think about how a streaming service like Netflix rolls out a new feature, say a new recommendation algorithm. They do not push it to every user worldwide at once. Instead, they start with a tiny group, maybe just their own employees. That is the innermost ring. They watch how it performs. Does it crash the app? Does it slow down loading times? Once they are confident, they expand to a small percentage of real users, say 1% of subscribers. That is the next ring. They monitor feedback and error logs. If everything looks good, they increase the rollout to 25%, then 50%, then 100%. This staged approach limits the blast radius if something goes wrong.

An update ring in Windows deployment works exactly the same way. Your company has thousands of laptops. The IT department creates four rings. Ring 1 contains only 10 devices, the IT team's own computers and a handful of test machines. These get every Windows update the day Microsoft releases it. Ring 2 contains 50 devices belonging to the most technically savvy employees in the engineering team. They get updates after a 5-day delay. Ring 3 contains 500 sales and marketing laptops, these get updates after a 20-day delay. Ring 4 contains the remaining 1,500 devices, call center agents, warehouse terminals, and executives. Ring 4 gets updates after a 45-day delay.

Now imagine a new Windows update causes a known issue where a specific VPN client stops working. Because the update was only pushed to Ring 1 and Ring 2, only 60 devices are affected. IT identifies the problem within hours. They pause the update for all other rings. They work with the VPN vendor to get a patch. Once the patch is ready, they allow Ring 3 and Ring 4 to receive the updated version of the update. The business never experienced downtime because the update never reached the critical call center machines. That is the power of update rings, it is controlled, cautious, and deliberate.

## Why it matters

In any organization that manages more than a handful of Windows devices, unmanaged updates are a ticking time bomb. Without update rings, every device would either install updates the moment they are released, or never install them at all, both extremes are bad. The first extreme leads to chaos when a bad update bricks machines. The second extreme leaves the organization vulnerable to security exploits. Update rings strike the balance.

From a practical IT standpoint, update rings give administrators control over the update experience. They allow you to defer updates during critical business periods. For example, a hospital cannot afford a system restart during a surgery, but it also cannot afford to be weeks behind on security patches. With rings, the pharmacy terminals can be in a ring that installs updates on Wednesday at 2 AM, while the ER workstations are in a ring that updates on Saturday at 3 AM. This level of granularity prevents disruption.

Update rings also enable compliance with regulatory frameworks. Many industries require that systems are patched within a certain window (e.g., 30 days for critical vulnerabilities). Using rings, an IT manager can prove that all devices in the "HIPAA" ring received the security patch within 14 days, while the "non-sensitive" ring received it within 30 days. The reporting capabilities in Intune and WSUS provide audit trails for exactly this purpose.

Finally, update rings reduce the support burden. When updates roll out slowly, the help desk handles only a trickle of problems instead of a flood. The IT team can document known issues and prep workarounds before the next ring receives the update. This proactive approach is the hallmark of professional IT operations. Without rings, an IT department is always reacting to fire drills caused by bad updates.

## Why it matters in exams

Understanding update rings is essential for several certification exams, particularly those focused on Microsoft 365 modern desktop administration and Windows client management. For the MD-100 (Windows Client) exam, which is part of the Microsoft 365 Certified: Modern Desktop Administrator Associate credential, update rings are a core objective under "Manage Windows Updates." Candidates must know how to create and configure update rings, understand deferral periods, and differentiate between feature updates and quality updates. Exam questions often present a scenario where a company has multiple departments with different update needs, and you must select the correct ring configuration.

For the MS-101 (Microsoft 365 Mobility and Security) exam, update rings appear in the context of co-management between Configuration Manager and Intune. Candidates need to understand how update rings interact with Windows Update for Business policies and how to configure rings in a hybrid environment. Questions may ask about the impact of deferral settings on compliance policies.

The AZ-800 and AZ-801 exams (Windows Server Hybrid Administrator) touch on update rings when discussing Windows Server update management. While the primary focus is on WSUS and server patching, the concept of rings applies to group-based update approval using GPOs. Expect scenario-based questions where you must decide how to structure OUs and GPOs to achieve staged rollouts.

Even general IT certifications like CompTIA A+ (220-1102) and CompTIA Network+ include the concept of patch management strategies, which is where update rings fit in. While they may not use the exact term "Update ring," the idea of piloting patches before wide deployment is a key troubleshooting best practice. Multiple-choice questions may ask: "What is the best practice for deploying a major operating system update in a corporate environment?" The correct answer will involve staged rollout or pilot groups.

For the Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) exam, which replaces the MD-100 and MS-101, update rings are a primary objective. The exam blueprint explicitly lists "Plan and implement update rings" under "Manage Windows 365 and Windows client." You can expect drag-and-drop questions where you match ring settings (deferral days, deadline days, pause) to business requirements. Performance-based labs may ask you to create three update rings in Intune with specific deferrals and then assign them to device groups.

In all these exams, the key to scoring points is understanding the relationship between update rings, device groups, and deployment channels. You must know that a ring is a policy object, not a device group itself, devices are assigned to rings via Azure AD groups. Also, know that you can pause an update ring to stop further rollouts without deleting the policy. These details appear in multiple-choice, scenario, and case-study question types.

## How it appears in exam questions

Exam questions about update rings generally fall into three categories: configuration scenarios, troubleshooting scenarios, and comparison scenarios.

In configuration scenarios, you will be given a business requirement and asked to select the correct ring settings. For example: "A company has 2000 Windows 10 devices. The IT team wants the first 50 devices to receive updates immediately for testing. The next 500 devices should receive updates after a 7-day deferral. All remaining devices should receive updates after a 30-day deferral. Which update ring configuration should the administrator create?" The answer will involve creating three separate rings with different deferral values and assigning the correct Azure AD groups to each ring. You must also know that the deferral for feature updates can be set independently from quality updates. A common distractor is setting the same deferral for all rings, which would not meet the business requirement.

In troubleshooting scenarios, you might be told that users in a certain department are not receiving a critical security update even though other departments have installed it. The question will ask why. The answer could be that the update ring assigned to that department has a long deferral period, or that the ring has been paused by an administrator. Another troubleshooting pattern involves updates failing to install because the deferral deadline has been set too tightly, causing devices to miss maintenance windows. You need to recognize that the deadline setting forces installation, but if a device is offline during the window, it will install at next boot, and this might cause disruption if users are not warned.

Comparison scenarios ask you to differentiate update rings from other update mechanisms. For example: "What is the primary advantage of using Windows Update for Business with update rings compared to using WSUS alone?" The correct answer relates to cloud-based management, automatic deferral control, and built-in reporting. Another comparison might be between update rings and GPO-based update configuration, the answer will highlight that update rings are easier to manage at scale and provide faster rollout control.

Some questions test your understanding of the difference between pausing an update ring and deleting it. If a ring is paused, updates already delivered to devices are not rolled back, but no new updates are offered to devices in that ring. If a ring is deleted, devices lose the policy and may fall back to default Windows Update behavior. You must be able to recommend the correct action when a bad update is discovered mid-rollout.

Performance-based questions may ask you to navigate the Intune portal and complete a task. For example: "Configure an update ring named 'Finance' with a 14-day deferral for feature updates, a 7-day deferral for quality updates, and a deadline of 5 days. Assign this ring to the Finance-Devices Azure AD group." You must know where to find the update rings blade in Intune, how to set deferral sliders, and how to select the target group.

## Example scenario

You work as a desktop administrator for a mid-sized law firm with 300 Windows 10 laptops. The firm handles sensitive client data and must remain secured against vulnerabilities, but the partners hate reboots during business hours. Your job is to set up update rings to keep every machine patched without disrupting work.

You create three rings in Intune. Ring 1 is called "Test - IT and Legal Ops." It contains 10 laptops belonging to the IT team and the legal operations manager. You set deferral for feature updates to 0 days, they get the latest Windows version immediately. For quality updates, you set a 2-day deferral. You set an installation deadline of 3 days. This ring will catch any immediate issues with new updates.

Ring 2 is called "Pilot - Associates and Paralegals." It contains 70 laptops. You set feature update deferral to 7 days and quality update deferral to 5 days. Deadline is set to 7 days. This ring will receive updates a week after release, giving your IT team time to identify any issues from Ring 1. If a problem surfaces, you can pause Ring 2 before it rolls out.

Ring 3 is called "Production - All Others." It contains the remaining 220 laptops belonging to partners, senior counsel, HR, and accounting. You set feature update deferral to 30 days and quality update deferral to 14 days. Deadline is 14 days. This means partners get updates a full month after release, which is what they want.

Now imagine that a new Windows quality update from Microsoft causes a known conflict with the legal document management software used by the firm. After testing in Ring 1, your IT team confirms the issue. You immediately pause Ring 2 and Ring 3. You submit a ticket to the software vendor and get a compatibility patch within 48 hours. Once the patch is tested in Ring 1, you unpause Ring 2, then Ring 3. The law firm never experienced downtime because the update never reached 95% of the machines until it was safe. This scenario shows how update rings provide a safety net for critical business operations.

## Common mistakes

- **Mistake:** Assuming that once an update ring is created, all devices in that ring will immediately receive the update.
  - Why it is wrong: Update rings only define the policy for when updates are offered. The actual update depends on Microsoft release schedules, device check-in times with Intune, and the specific deferral settings. Devices may not receive updates until they check in, which can happen every 8-24 hours.
  - Fix: Remember that update rings set the deferral period from the date Microsoft releases the update, not from the date you create the ring. There is always a delay between ring creation and first update delivery.
- **Mistake:** Setting the same deferral for feature updates and quality updates in all rings.
  - Why it is wrong: Feature updates and quality updates serve different purposes. Quality updates are critical security patches that should be deployed faster. Feature updates are major version upgrades that need longer testing. Using identical deferrals defeats the purpose of staged rollout.
  - Fix: Always set quality update deferral to a shorter number of days than feature update deferral. For example, 5 days for quality versus 30 days for feature updates in a production ring.
- **Mistake:** Deleting an update ring to stop a bad rollout instead of pausing it.
  - Why it is wrong: Deleting a ring removes the policy from all assigned devices, causing them to fall back to default Windows Update behavior. This might cause them to immediately download the bad update. Pausing a ring stops the rollout without removing the policy.
  - Fix: Use the pause function to stop updates from being offered to a ring. Pause for up to 35 days. This gives you time to resolve issues without losing your ring configuration.
- **Mistake:** Thinking update rings control which specific updates are installed, not just the timing of installation.
  - Why it is wrong: Update rings cannot exclude specific updates. They only control the deferral and deadline. If you need to block a particular update, you must use Windows Update for Business policies or WSUS approvals.
  - Fix: Use update rings for timing control, not for content control. If you need to approve or block individual updates, use WSUS or an update compliance policy instead.
- **Mistake:** Assigning the same device group to multiple rings simultaneously.
  - Why it is wrong: A device can only belong to one update ring. If you assign the same group to two rings, Intune will apply the settings of the ring with the highest priority (or the most recently assigned). This causes confusion and unpredictable behavior.
  - Fix: Ensure that each Azure AD group used for update rings contains only devices that you want to be governed by a single ring policy. Create separate groups for each ring.

## Exam trap

{"trap":"On an exam, you are asked: 'An administrator wants to ensure that critical security updates are installed on all devices within 7 days of release, but feature updates should be delayed by 45 days. Which configuration should be used?' Some answer choices will suggest creating separate rings for security and feature updates, or using different policies for each.","why_learners_choose_it":"Learners mistakenly think that because feature updates and quality updates have different timelines, they need separate rings or separate policies. They do not realize that a single update ring can have independent deferral settings for each type of update.","how_to_avoid_it":"Remember that within a single update ring configuration, you have distinct drop-downs or sliders for 'Feature update deferral period (days)' and 'Quality update deferral period (days).' One ring can handle both timing requirements simultaneously. You do not need multiple rings or separate policies for this."}

## Commonly confused with

- **Update ring vs Windows Update for Business (WUfB):** Windows Update for Business is the entire service that allows IT to manage updates on Windows devices. Update rings are just one configuration object within WUfB. WUfB includes other features like delivery optimization, feature update policies, and reporting. Update rings are the specific policy that controls deferral and deadlines. (Example: Think of WUfB as the entire kitchen, and update rings as the recipe cards that tell you when to cook different dishes.)
- **Update ring vs Group Policy Object (GPO) for Windows Update:** GPOs are used in on-premises Active Directory environments to configure update settings. Update rings are used in cloud-based Intune environments. GPOs require manual configuration of many individual settings, while update rings are a simplified, integrated interface in Intune. GPOs do not have the concept of deferral periods in the same way Intune rings do. (Example: A GPO is like writing instructions by hand on a piece of paper. An update ring is like using a pre-printed form with checkboxes. Both achieve the same goal, but one is much easier to use.)
- **Update ring vs Deployment ring:** The term deployment ring is often used generically to describe any staged rollout strategy. Update ring is the specific Microsoft term used in Intune and Windows Update for Business. Deployment ring can refer to any phase of a software rollout (app, OS, driver), while update ring is exclusively about Windows updates. (Example: A deployment ring might be used when rolling out a new CRM application. An update ring is specifically for Windows 10/11 updates.)
- **Update ring vs Maintenance window:** A maintenance window defines the specific time when updates are allowed to install (e.g., 2 AM to 4 AM on Saturday). An update ring defines which devices get updates and how long after release. They work together, the ring decides when the update is offered, and the maintenance window decides when it actually installs. (Example: The update ring says 'you get the update after 14 days.' The maintenance window says 'install it on Saturday at 3 AM.')

## Step-by-step breakdown

1. **Plan your ring structure** — Decide how many rings you need. Typically, organizations use three: Test, Pilot, and Production. For each ring, determine the deferral days for both feature updates and quality updates. Document which Azure AD groups will be assigned to each ring. This planning phase aligns ring design with business risk tolerance.
2. **Create the update ring policy in Intune** — In the Microsoft Endpoint Manager admin center, navigate to Devices -> Update rings for Windows 10 and later. Click Create profile. Give it a name like 'Finance Ring - 30 day deferral.' Configure the deferral settings for feature updates (e.g., 30 days) and quality updates (e.g., 14 days). Set the deadline for automatic installation (e.g., 7 days after deferral ends).
3. **Configure additional settings** — Set the automatic update behavior (e.g., 'Download and install at scheduled time'). Choose the notification level for end users. Decide whether to allow updates to be paused by users. You can also set the 'Allow feature update to be installed on Windows Update for Business devices' toggle. These settings control the user experience and enforce compliance.
4. **Assign the ring to an Azure AD device group** — Under the Assignments tab of the ring profile, select the Azure AD group that contains the devices you want to target. For example, assign the 'Test Ring' to the group 'IT Test Devices.' Intune will apply the ring policy to all devices in that group. Remember that one device can only belong to one ring.
5. **Monitor rollout and adjust as needed** — After the ring is deployed, monitor the update compliance reports in Intune. Check how many devices have pending, successful, or failed installations. If a bad update is discovered, use the pause function on the ring to stop further rollouts. If the ring settings need tweaking (e.g., deferral was too short), you can edit the ring profile and save changes, but existing devices already offered the update will not be affected retroactively.
6. **Repeat for additional rings** — Create separate ring profiles for each group. For example, a 'Pilot Ring' with 7-day feature deferral and 5-day quality deferral, and a 'Production Ring' with 30-day feature deferral and 14-day quality deferral. Assign each to its respective Azure AD group. This staggered structure completes the staged rollout setup.
7. **Periodically review and retire old rings** — As your organization evolves, you may need to add or remove rings. For example, if you migrate from on-premises WSUS to cloud-only Intune, you may consolidate rings. Review ring assignments quarterly to ensure they still match device groups. Remove unused rings to simplify management.

## Practical mini-lesson

Let us walk through a real-world configuration of update rings in Intune, step by step, so you understand exactly how professionals set this up.

First, you need to understand that update rings exist as policy profiles in Microsoft Endpoint Manager. To create one, you sign in to the admin center at endpoint.microsoft.com. You navigate to Devices -> Windows -> Update rings for Windows 10 and later. Click 'Create profile.' You are given a form with several sections.

In the Basics tab, you give the ring a name. Choose something descriptive like 'Production - 30 day deferral.' Do not use 'Ring 1' because you will lose track of what it does as you create more rings. Add a description stating the purpose: 'All production devices get feature updates after 30 days and quality updates after 14 days.'

In the Update ring settings tab, you configure the core options. The most important are the 'Feature update deferral period (days)' and 'Quality update deferral period (days).' These are independent. Set them based on your ring plan. You also set the 'Feature update deadline' and 'Quality update deadline', these are the number of days after the update is offered that the device must install it. A common mistake is setting the deadline too tight, like 2 days, which forces installation during business hours if the device does not have a maintenance window configured.

Next is the 'Automatic update behavior.' Choose 'Download and install at scheduled time' for most production rings. For test rings, you might choose 'Notify the user to download' so you can manually control timing. Under 'Restart checks,' you can allow the device to check for active hours and system critical activity before forcing a reboot.

Now, go to the Assignments tab. You must assign this ring to an Azure AD device group. This is critical: devices must be members of the group. If you assign a user group, the ring policy applies only when that user is signed in, not recommended. Always create device groups for update rings. For example, you might have a group called 'All Windows 11 Workstations', but that would put every device in one ring. Instead, create groups like 'Finance Ring Devices,' 'HR Ring Devices,' and so on.

After you create the ring, it appears in the list. The policy will apply to new devices in the assigned group within about 8-24 hours. To verify, you can check a device's Update settings, it will show the ring name under 'Updates configured by your organization.'

What can go wrong? If you forget to set an installation deadline, devices may never install the update because users can snooze the notification indefinitely. If you set the deadline to 0 days, the device must install immediately, which can disrupt work. If you assign the same device group to two rings, only one ring applies, Intune uses a conflict resolution mechanism that might not be the one you expect. Always use exclusive device groups.

Professionals also use update rings in conjunction with delivery optimization to reduce bandwidth usage. They set up peer-to-peer sharing within the same ring so devices can share update downloads, saving network traffic. This is especially important for large feature updates that can be several gigabytes.

Finally, know how to pause and resume rings. When you pause a ring, devices already offered the update are not affected, they will still install it based on their existing policies. But new devices in the ring, or devices that missed the offer, will not receive it until you resume. Pausing is safe; deletion is dangerous. Always pause before you consider deleting.

## Memory tip

Remember 'Rings control speed, not content', update rings decide when updates arrive, not which updates are allowed. For content control, use WSUS or update compliance policies.

## FAQ

**Can I assign the same device to two different update rings?**

No. A device can only be assigned to one update ring. If you assign the same device group to two rings, Intune will apply the policy from only one of them (usually the most recently assigned or the one with higher priority). Always use separate Azure AD device groups for each ring.

**What happens if I pause an update ring?**

When you pause an update ring, devices in that ring will not be offered any new updates for up to 35 days. However, devices that have already been offered an update will still proceed to install it according to their existing deadline settings. Pausing does not roll back updates already installed.

**What is the difference between deferral and deadline?**

Deferral is the number of days after Microsoft releases an update that a device will wait before being offered that update. Deadline is the number of days after the update is offered that the device must install it. Deferral delays the start; deadline forces the completion.

**Can I use update rings for Windows Server update management?**

Update rings are designed for Windows 10 and Windows 11 client devices. For Windows Server, you should use WSUS or Azure Update Manager. However, the concept of staged rollout using groups applies to both client and server environments.

**Do I need to create separate update rings for feature updates and quality updates?**

No. A single update ring profile contains separate settings for both feature update deferral and quality update deferral. You can configure different deferral periods for each type within the same ring. There is no need to create separate rings.

**How do I know which update ring a specific device belongs to?**

You can check the Windows Update settings on the device itself by navigating to Settings -> Update & Security -> Windows Update -> View configured update policies. The ring name will be displayed. Alternatively, in Intune, you can view the device properties and look at the 'Update ring' field in the device's policy list.

## Summary

An update ring is a fundamental policy object in Windows 10 and Windows 11 deployment that allows IT administrators to control the timing and pace of update rollouts. It works by defining deferral periods, deadlines, and notification behaviors, which are then applied to devices grouped in Azure AD. The primary purpose is to enable staged deployments, where a small number of devices receive updates first for testing, followed by larger groups after a delay. This approach minimizes the risk of a bad update causing widespread disruption.

For IT professionals, update rings are a daily tool for managing device compliance and security. They do not replace the need for proper testing labs or WSUS for update content control, but they provide a simple, cloud-native way to enforce update policies across thousands of devices. The ability to pause a ring when issues arise gives administrators a safety net that is crucial in modern IT operations.

In exams, update rings appear most prominently in Microsoft certification paths, especially the MD-100, MS-101, MD-102, and AZ-800/801 exams. You must understand the difference between deferral and deadline, know that one ring can control both feature and quality updates, and be able to configure rings in Intune. Remember that update rings control speed of rollout, not which updates are installed. With this knowledge, you can confidently answer scenario-based questions and perform lab tasks related to Windows update management.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/update-ring