Microsoft has elaborate however you should usage Windows Update policies to support your devices updated and secure, from single-user devices close done to kiosks and billboards – and rollercoasters.
The tech giant's archetypal spot of proposal for admins utilizing Windows Group Policy to negociate endeavor Windows 10 and Windows 11 devices is don't messiness excessively overmuch with the defaults.
Admins shouldn't effort excessively hard to customize instrumentality information patching and diagnostic updates due to the fact that the defaults are "often the best", according to Microsoft. This absorption connected defaults keeps users blessed and productive, portion ensuring devices are patched and up to date.
Admins tin usage Group Policy to power the timing of updates for Patch Tuesday, exigency patches, and new diagnostic releases of Windows. The default for Windows Update successful the endeavor is overmuch similar the acquisition for consumers connected Windows PCs. But determination are galore different ways Windows and Windows Update is utilized to support each mode of devices operational erstwhile needed and besides patched regularly during downtime.
The default Windows Update argumentation is for devices to scan daily, automatically download and instal immoderate applicable updates "at a clip optimized to trim interference with usage, and past automatically effort to restart erstwhile the extremity idiosyncratic is away," according to Microsoft elder programme manager Aria Carley.
"Leverage the defaults!" Carley said.
But determination are truthful galore usage cases for Windows that the defaults can't screen each scenario. Besides single-user idiosyncratic Windows devices, determination are: multi-user devices; acquisition devices; kiosks and slope ATMs; mill machines, rollercoasters, and captious infrastructure; and Microsoft Teams Rooms devices.
While the defaults are a bully baseline, Carley offers details astir however to usage Group Policy to tweak the timing of automatic updates for each usage case. She's besides compiled a list of 25 Group Policy settings that admins should not use.
For usage cases wherever Group Policy tin beryllium used, admins tin specify "the fig of days earlier an update is forced to install" during progressive hours, erstwhile the idiosyncratic whitethorn beryllium present. This is applicable to single-user devices that could beryllium connected to the firm web oregon utilized remotely.
Microsoft recommends the usage of deadlines due to the fact that of heightened information risks from ransomware and destructive malware. The US Cybersecurity and Infrastructure Security Agency (CISA) is concerned destructive malware whitethorn people US organizations owed to US sanctions connected Russia implicit its penetration of Ukraine.
Multi-user devices similar HoloLens oregon a PC successful a laboratory oregon room mounting whitethorn person acceptable periods successful which they are used, specified arsenic a building's opening hours. Updating these astatine midnight, erstwhile unit are away, could beryllium ideal.
For acquisition device, admins tin guarantee Windows update notifications oregon automatic reboots don't hap during the schoolhouse day. To bash this portion remaining patched, admins tin cheque the caller Group Policy container enactment "Apply lone during progressive hours".
However, this diagnostic is presently lone for devices successful the Windows Insider Program for Business successful the Dev oregon Beta channels. Microsoft notes: "For those connected Windows 10 oregon Windows 11, mentation 21H2 devices, we bash not urge configuring this and alternatively urge leveraging the default experience."
Another applicable Group Policy mounting is "Turn disconnected auto-restart for updates during progressive hours", which overrides Microsoft's default "intelligent progressive hours" – a measurement that is calculated connected the devices based connected idiosyncratic usage.
For things similar kiosks, billboards and ATMs, owners whitethorn privation for nary notifications oregon car reboots, and similar to reboot during 'low visibility' hours. There are 4 applicable policies for these devices to debar notifications that would beryllium useless and disruptive to passive users, arsenic good arsenic reboots during emblematic progressive hours. Admins person an enactment to acceptable the update to hap astatine 3AM daily, the assumed debased visibility hour.
There are immoderate devices that you mightiness not deliberation of arsenic needing a Windows Update, but adjacent admins of mill devices, rollercoasters and captious infrastructure besides get proposal astir however to to negociate automate update behaviour if needed.
As Carley notes: "Machines connected the mill floor, rollercoasters astatine amusement parks, and different captious infrastructure tin each necessitate updates. Given the criticality of these devices, it is pivotal that they enactment secure, enactment functional, and are not interrupted successful the mediate of a task. Often these are immoderate of the devices successful the last question erstwhile rolling retired an update aft everything other has been validated."
Carley adds: "Note: This is 1 of the lone usage cases wherever compliance deadlines are not recommended fixed automatic updates are ne'er acceptable successful this scenario."