#wufb — Public Fediverse posts on home.social

For many users (and unfortunately administrators), #updates are evil. Updates require a reboot, which for computers can mean interrupting work in progress. In the case of servers, this can result in the unavailability of the server. So updates are often pushed back and not installed.

But updates are necessary. Updates include #vulnerability #fixes. And if updates are not installed quickly enough, including the required reboot, vulnerabilities in the system can often be very easy targets for a threat actor.

In #incident #response, which is my primary role, we almost always see unpatched systems, and very often we find that the threat actor has just exploited a known vulnerability that had an update available which was not applied.

Within #Intune, it is possible to configure Windows Update for Business (#WUfB), which is a modern option for controlling and managing updates from the cloud. There are four types of policies that can be applied.

Update Rings define when to install updates, both deferral and deadline. Deadline is important to configure because the deadline tells the latest date by which updates must be installed, including mandatory reboots. If ignored by the user, the update is forced on the deadline date and the system reboots.

Feature updates are updates that add new features to the system. Feature updates can be used to install new versions of Windows, for example Windows 11 22H2. While the feature update policy is active, devices are kept on the set version.

Quality updates are regular monthly updates. With quality updates policies, you can control the monthly updates and define when they should be applied to devices.

Driver updates allow you to manage driver updates. You can set up automatic approval of recommended drivers or manually approve all drivers.