Control Windows Update for Business using the deployment service and PowerShell

• Author
• Recent Posts

Brandon Lee

Brandon Lee has been in the IT industry 15+ years and focuses on networking and virtualization. He contributes to the community through various blog posts and technical documentation primarily at Virtualizationhowto.com.

Latest posts by Brandon Lee (see all)

• ManageEngine OpManager: Comprehensive monitoring for on-prem, cloud, and containers - Thu, Mar 23 2023
• Install K3s, a lightweight, production-grade Kubernetes distro - Mon, Mar 20 2023
• VMware NSX Advanced Load Balancer: Installation and configuration - Fri, Mar 10 2023

The new service is designed to work in conjunction with the WUfB policies you have in place today and integrates seamlessly with Microsoft's Endpoint Manager cloud offering. In addition, it provides IT admins with more granular features from a management perspective and allows controlling updates in a programmatic way using PowerShell.

While the plain WUfB provides deferral policies and deployment rings, this may not provide the control granularity admins need in their environment. So how does the deployment service enhance WUfB?

• Schedule update deployments to start on a specific day—You can schedule the exact date for update deployments.
• Stage deployments over a specific period of time—You can stage deployments over days or weeks. For example, you can deploy 21H2 to 500 devices per day, beginning on January 22, 2022.
• Manage firmware and drivers—With the deployment service, you can manage updates for firmware and drivers like you do feature and quality updates.
• Bypass preconfigured policies to immediately deploy emergency security updates—If an emergency security update is released to patch a vulnerability, the deployment service makes it easy to bypass the preconfigured policies that might prevent endpoints from receiving the critical security update.
• Automatic piloting for unique business requirements—This helps ensure coverage of hardware and software in your organization.
• Uses Microsoft artificial intelligence (AI) and machine learning (ML)—This helps to quickly identify issues with updates and hold the deployment from other devices.

How the deployment works

The deployment service uses existing device policies and update compliance settings. It controls them using a new cloud-based mechanism that is exposed programmatically.

Windows Update for Business deployment service direct API communication

Instead of interacting with clients directly, the deployment service's cloud controls communicate with the Windows Update service using a management tool such as Windows PowerShell. PowerShell interacts with the Microsoft Graph REST APIs. This direct communication provides management granularity and features that were not possible before the WUfB deployment service.

Using the WUfB deployment service

First, to use the WUfB deployment service, you need to have one of the following Windows 10 or Windows 11 editions installed:

• Pro
• Enterprise
• Education
• Pro Education
• Pro for Workstations

Additionally, your organization must have one of the following subscriptions:

• Windows 10/11 Enterprise E3 or E5
• Windows 10/11 Education A3 or A5
• Windows Virtual Desktop Access E3 or E5
• Microsoft 365 Business Premium

Install the SDK and connect to Microsoft Graph

The Microsoft Graph PowerShell SDK allows admins to interact directly with the Microsoft Graph service using PowerShell. In addition, the included libraries provide commands to deploy and control updates from the WUfB deployment service.

To install the SDK, create a profile (required), and connect to the API, run the following:

Install-Module Microsoft.Graph
Select-MgProfile -Name "beta"
Connect-MgGraph -Scopes "WindowsUpdates.ReadWrite.All"

Examples of using the WUfB deployment service

Let's consider examples and code snippets using the PowerShell SDK connected to Microsoft Graph to control Windows Updates.

Enroll a device:

Invoke-MgEnrollWindowsUpdatesUpdatableAsset `
 -UpdateCategory "feature" -Assets @(@{
 "@odata.type"= "#microsoft.graph.windowsUpdates.azureADDevice";
 "id" = <AAD Device ID GUID>
})

Check enrollment status:

Get-MgWuUpdatableAsset -UpdatableAssetId <AAD Device ID GUID>

Create a deployment for a feature update (21H1):

New-MgWindowsUpdatesDeployment -Content @{
 "@odata.type" = "#microsoft.graph.windowsUpdates.featureUpdateReference";
 "version"= "21H1"
}

Deploy a feature update at a specific date and time:

New-MgWindowsUpdatesDeployment -Content @{
  "@odata.type" = "#microsoft.graph.windowsUpdates.featureUpdateReference";
     "version"= "21H1"
     }
-Settings @{
  "rollout" = @{ 
  "startDateTime" = [DateTime]"2021-14-09T17:00:00Z"
  }
}

Concluding thoughts

The new WUfB deployment service will provide IT admins with much more granular control over how Windows updates are applied across the Windows client estate.

By interacting directly with the Microsoft Graph REST API using the PowerShell SDK, admins can programmatically control how Windows Updates are approved, scheduled, monitored, and applied, including safeguards from problematic updates.