HTMD MI2️⃣2️⃣Intune Windows 10 Update Feature Rings Troubleshooting 📌How to Pause Quality Updates

thank you all for joining in this is episode number 22 free in tune training provided by my how to manage devices community and if you have any questions related to this training or any device management questions please go to forum.howtomanagedevices.com we are ready to answer your questions over there right okay so getting into in tune topic for today yesterday we had deployed windows 10 feature updates right so there was a mission where it was waiting for 1909 upgrade restart right and we deployed windows 10 feature update to that particular mission okay so before before going into that particular scenario i wanted to show the hdm hdmd ring which we created for windows update right this is windows update ring right windows 10 update ring so you know the difference between windows 10 update ring and windows 10 feature updates if you don't uh if you have not been part of the previous episodes please watch the youtube video youtube playlist so you will you will get all the recordings and all the details right so before going into windows 10 feature updates i just wanted to update or i just wanted to rename this to windows 10 update ring right so i just said windows 10 so i mentioned only hdmd ring one over here right i'm going to add windows 10 update update ring because that makes more sense okay and that will give more understanding like when somebody else kind of look into it right so they will come to know and if we look from a troubleshooting perspective from a client per client side or from a device blade if if we go to device troubleshoot troubleshooting plus support and you select a user probably it will be helpful to understand which is this policy right so i'm going to go to windows 10 feature updates right and yeah this is more useful uh name uh it says feature at least right so we have we had deployed this yesterday let's see what is what is there right whatever what does the end user update start as you can see okay so it says up to date up to date up to date right zero three is i think uh domain join uh azure ready join device and zero two is the device which we had um we had seen it was waiting for a restart right let's so let me check this is okay this is mdm only okay so let me let me show this where is it okay if i go to updates right so this is this was waiting for the restart yesterday this was waiting for 1909 restart and then we did a feature update policy to stop the feature update on this mission right so we did how how did we do that so if i go to properties and if you can see you can see like feature update setting is set to 1903 so this this mission will stay in 1903 unless we change this to 1909 or some other uh latest versions of windows 10 right so that is why as you can see over here in this mission or in this device now that 1909 restart is not coming up right and if you want to check if you don't believe me so if i check windward is so you can still see it is 1903 version so it stopped um the 1909 restart somehow not somehow because of the intune policy right this is in tune zero four mission so so let me check what is the start as it shows in in tune zero four in the console right in tune console it says reboot pending right so before i'm going to reboot that um for the first time after after the policy uh which we deployed yesterday right so before that i wanted to show you some two things right one is event lock so i was checking the event log to today morning right and i was checking what happened during the yesterday's training time right so that was 8 56 around 8 8 30 8 56 so it got to three new updates at that time it was 18 yesterday right so today is 19 it us 18 may yesterday so it got to update three updates and updates was downloaded right so this was all happened on 18th right after we updated the policy so before that if you see oh not this one you could see this is this is one more event right so if you see the general you won't come to know like what is it exactly right so it's always recommended to go to re detail right in the event log and check what is there so it says windows 10 1909 right so it got downloaded it says right update was downloaded right so this was on 15th right on 15th update got downloaded right but on 18th we applied the policy and on 18 before applying the policy you could see that the update was waiting for the restart 1909 1909 update was waiting for the restart right okay and one more thing i wanted to show is basically somebody asked me um whether the user can change the active hours right so i did check that on couple of missions on this mission also on my production mission also right and if i change it to for example nine o'clock right for example nine o'clock and i'm going to accept it yes right and i'm going to save it okay so it still says eight okay even though i changed it to nine it has automatically revert it back to eight o'clock okay so let me change this also right to seven seven pm okay so let's save it so again it shows five eight to five so so that's not allowed for the user to change right okay and one more thing i wanted to show quickly is about the registry entry right so in yesterday's episode we have seen registry entries this one we have seen this registry entry right if you remember right so then i was i was looking into the documentation in this documentation it says this is the pause this is a registry entry to post the quality updates etcetera etcetera right so then i was started i started looking into uh what is what is the what is the registry entry specifically for in tune type of policy right where where intune is creating whether intune is creating any policy registry entry or not so basically over here i could see a policy manager hive and in the policy manager i could see there are a lot more entries that is very valuable for kind of troubleshooting from uh in tune perspective as well right so that is this is that that entry right so you can see the active hour end timing over here right in this registry right it's 17 hours 17 hours means 5 o'clock 5 pm right so that is what the same thing you can see over here 5 p.m right so so all these entries are very useful in the troubleshooting so please if you have any doubt about the troubleshooting and how to do about the troubleshooting you can go through all these entries so these are these are like very uh very valuable uh registry entries right so configure deadline for update um feature update configure deadline for quality updates so all these are very uh useful information in the registry right manage preview bills you can see like there were like different options like you can deploy the insider update patches also uh when we created windows 10 updates in a policy right okay so that those were the cube things which i wanted to show i don't want to open this actually that was a mistake okay anyways so now what i'm going to do is as as i said this is windows 10 1903 now and in the as per the intune report it shows pending for restart so let's give a restart right and check what is going to happen over here right cmd is already there shutdown minus r minus f minus f minus t come on sorry okay so let's let's get restarted okay so okay that let's wait for the what we start to happen and now this is the another mission right this is azure adi joined device okay and in the azure radio join device also you can see the same registry entries which i showed right so there are two registry places which you can look into one is specific to windows update for business the other one is specific to the policy manager etc right so here also i tried to change the active hours and it didn't change okay so it's the same thing okay so let's let's go back to the portal in tune portal now i just remembered one thing let's check whether it got updated to the latest version no not it okay still 2004 okay so let's select windows and let's see what we can do in windows 10 update ring right so windows 10 update ring one now these are the interesting options which are not available in ssc numbers in sscm right so first option is pause right i i have not seen any option like pause in sscm a software update deployment so probably i would say this is an advantage right so probably you can say like something like uh um what is that called i forgot the name there's a new um new option enabled uh in sscm based on the percentage we can post the deployment etc etc right percentage of success so that is that is a really nice feature in sscm but you don't have a direct option to post right so for example if i want to post so we have deployed we have deployed feature updates and quality updates in this policy right so for example i did a ring one and um i have found that probably 10 missions in the ring one out of 20 having problem right then i wanted to post that quality update right so what we can do is go to pause menu over here and say like quality pause quality update so it says are you want to pause quality updates for this ring yes i said like yeah i want to post this because it's causing an issue in my environment right i i want to do more troubleshooting and then i want to resume this right so once you once i post it right i i don't have that pause option again right so i don't have that post or post option again here for the quality updates it's only for the feature updates so i remember you have i don't know whether you remember or not but i have we have mentioned the difference between quality updates and feature updates right quality updates are basically patches monthly patches security updates right and feature update is windows 10 upgrade right so we post the quality updates and probably if we go to this mission now right and we do a sync right let me sync and let me go to event log right event even even viewer if i can type it correctly applications so for the sync and related to the policies where you want to check um i think i i mentioned this couple of days before right this is this is the place microsoft windows and device this is the place to look into device management enterprise this is the log file for the mdm right so this is 8 16 so so that is the latest one i feel 8 16 38 okay let me give a refresh just to make sure okay so it's 34 now and it says this is probably the fake id which fake policy which yeah which we had seen yesterday also right this is fake policy i don't know uh intune team is doing some testing or admx thing okay so if we can ignore this uh that is a known issue okay so off offline domain you're in connection no that is not relevant for us to so successfully sync okay it says pass successfully so yeah i feel it is synced successfully right so let me go back to windows 10 sorry windows update agent over here right windows update agent where is it windows update agent i'm missing that uh registry kind of browsing capabilities here like in registry it's very useful right when if i if i want to go to something i can say like oh updates and i can just click on update right and i can just send type in press enter it will take you to the same folder structure right in policy so the sorry in registry that is that is interesting that is very useful option but i'm missing that over here in event logs okay so let's check it is eight five sorry seven five so there's no policy update over here so nothing came here so it is kind of a policy thing right so that is why it didn't probably contacted the initiated the windows update agent thing so let me go back to over here see after update it says the updates are post right so we did a post over there for uh from in tune right and you can see the the poses there already there right so that's that's a really nice option right if you have a problem with windows 10 updates then you can do this okay or windows 10 update when i say windows 10 update this we did it we did this for quality updates right monthly patches okay so let me connect back to the device which we restarted before going before doing that let me try to check what is the status of that particular device right no that was feature updates so feature updates we did a restart of a device which was pending for reboot as per the as per the report it stay still stays spending for restart even though he restarted the device zero four mission right so let's connect back to that mission this is azure ready joined uh device i think registered device i don't remember whether this is the one or the other one it was other one okay anyways let me connect to both the missions no it was the other one i think yeah this this was already a 1903 sorry 1909 mission this this was the one mdm okay yeah ip address is 16 so it was that was the one okay so it got connected back and let me launch the command prompt and see what does their host name if i can type hostname send scene204 as you can see in the log the intune report right and i logged in with the local username and password because because this is my byod mission this is my personal vision right so if you are not sure what does byod cyod probably it's better to uh just start watching the videos right the previous recordings that you will come to know like what is exactly byu and cbio scenario and how to register a device to intune etc etc right okay so so that is done now let's let's open the settings and before that we were so oh okay that's that's interesting see now it got upgraded to 1909 that's that's really bad thing it did right it didn't it didn't apply our policy okay so what we learned from here we should we should apply the pause policy for future updates well before downloading the updates right 1909 update and uh then only it will get up late right it cannot overrate the previous policies it seems right so probably that could be a known issue probably that might get fixed if it's a non-issue but if it's a if it's as per the same then you need to make sure uh before getting 1909 update or before getting any update right you need to put in the pause policy right so that means right for example whenever the best practice would be in that case right best practice would be if i can go back no this one okay feature updates right so future updates we put a pause or we said like i know i all my mission should be 1903 right so when we put that uh it was already 1909 and pending for reboot right at that time but what we did is we we anyways deployed it but uh thinking that it will and this policy will take over uh the updates right so so i think in the background it was already installed and it was waiting for the restart right so that is why this policy didn't get applied now the best practice is right whenever you have a 1909 mission right then i will say like okay now my policy is 1909 all all the missions should stay with 1909 i don't want 200 sorry 204 right whenever microsoft releases 204 otherwise my devices all devices will get uh 204 so it is better to create this kind of a policy uh before before getting the updates and uh before uh up downloading it the client missions downloading it right so i'm going to set this policy as 1909 now because all my missions are like 1909 in 1909 now right so let's see it still stays reboot pending 1903 right so let's see uh it will automatically change right anyways but anyways as you can see this mission is already upgraded to 1909 okay and this is with bit complex also right 1903 to 1909 is kind of um enhancement pack package right this is not a full upgrade this is like a patch upgrade feature feature even though it's a feature update uh you know like what if if you know what is enhanced enhancement package etc etcetera right so 19 in 1903 uh the old the code of 1909 is already there in 1903 right but you just need to enable uh some enhancements in the os with the patch right so that is exactly 1909 patch so you could see some difference in 20 20 2004 updates as well because that is a full full up upgrade right if i understand it correctly right okay so that was that was interesting learning okay uh so let me go back to windows 10 updates okay so i think it's 8 25 i think we we have covered a lot of stuff today probably you might have a lot of questions so i will post for the questions if you have any are you guys still there yeah okay so is this is this confusing or you need more time to understand it what is the what is the feedback so we need more time to understand this what is confusing it's not no yeah go ahead yeah yeah for me i think i missed a couple of videos i think two videos so for me it's confusing i have to see that video then i can i can see this so maybe that will be clear understanding for me for as of now yeah i am bit confused because yeah i have not attended two classes so maybe this could could be a problem for me okay how about others i hope it's clear for us because we have yeah yeah you can go yeah it's not confusing uh it's quite interesting just that we need to check the earlier videos and uh try to map properly okay do it in our lab or maybe uh it would be a little more easy to understand yeah so basically it's it's it's kind of simple right so as i mentioned uh so if you if you understand the overall architecture right how it works okay so let me try to try to explain in them bit more detail give me a sec where is it okay so this is the one right which we discussed initially right so in ssm world everything is coming down from sscm and w source right so policies content everything is coming down from sscm in a normal uh traditional sscm world and right i'm not talking about cmg and all the new stuff right which is which is there right but in id ideally uh we have seen for many years everything is coming from wsus and sscm right to the client and we can configure like we can select kb's in in from a ccm console and we can deploy it right but in in tune it's entirely a different architecture content is coming down from windows update right so there are two types of content right one is quality content software update windows 10 update that is quality updates monthly updates with security right so that is quality quality right one that is quality i don't i don't want yellow there okay quality and the other one is feature updates so feature update is feature update is basically windows 10 upgrade so the both these contents are coming down from microsoft update right directly right we are not deploying the content from intune intune is having only the policy configuration options right so two policy configuration options in tune is having those are like related to quality updates and feature updates right so these are the two policy configuration options which we have right so when you deploy a patch in sscm you will configure the user experience also right so that is what we are doing here so we have two policies here one is windows 10 update ring that is for quality basically for quality updates right and this is a preview of windows 10 feature updates right so these are the two policy configuration policies right so we need to configure this one for patching and and you need to make sure that feature update is definitely zero right over here if you are using feature updates option so that is a limitation at the moment but they are going to remove that probably in the future right so they are going to remove this free entire feature update option probably from from this from this policy okay so that will help you to understand so these are the only two policies that's it so straightforward right so overall two two types of contents and two types of policies in in tune right two types of content one is patch monthly patches and the other one is feature updates like windows 10 updates same same thing with the policies so yeah if you can go back to the previous videos and yeah go ahead so i have a question about here so we have seen in the future upgrade the days it will be appear zero so what is the difference i just make a confusion over there even if you are creating any feature updating ssm also we have to provide the dates right so what does that mean i am confused uh so if i can go to feature feature updates right you you mean to say feature updates or uh yeah so yeah it's interrupted okay so in future updates we don't have any dates right okay okay so so the idea idea over here is feature updates if you don't set this policy anyways my like it's it's based on windows update for business it will automatically happen right if you don't set this policy right it is going to happen automatically that is what happened with this device right it it got automatically updated before we created any policy right so this feature update policy is only for stopping that feature update right this is only for stopping so when i say 1909 it will stop there so it won't upgrade to 204 until we i changed this policy okay does that make sense if or yeah more confusing yeah it yeah yeah yeah it makes sense but you have uh see uh we have seen that uh zero dates in update ring right so so that is that is something different right so that is something different so over here if you see this is quality updates right so over here so you need to understand first thing right when a intune started right when it was like i don't know six months before or seven months before this policy was not there feature update policy was not there right okay so this is this is this is a preview policy you can see over here this is a preview policy it's not a production release yet okay so this is a preview policy the pretty new policy that is why you can see a duplicate policy sitting over here in the properties right over here you can see a zero right that is why like we used to create we used to control feature updates and quality updates from the same policy right before now they are moving away from this one probably that is why i said probably after a couple of months you would be you won't be able to see this option in this policy it will be entirely controlled by the other policy are you are you getting me yeah yeah yeah over here over here we what we used to do is like we used to put 365 or maximum allowed value is 365 okay 365 where is it 365 right so this was the maximum allowed value when i say 366 it will say like no it's not allowed right so we used to put 365 over here so what is the problem with 365 in in in organizations like we are still kind of running 1802 versions of windows 10 right if we put if we put at three 365 days that is only one year after that it will automatically get upgraded right so organization doesn't have any control right after 365 days to post the policy feature policy that is why they moved this policy from here right and they created a different policy to post this feature updates entirely so the full control is with your organization right you can entirely pause the feature updates so if you don't want uh 20204 you want all missions in 1909 you can set this policy up so that is a confusing part yeah i know and i think i think i have mentioned over here also in this right so limitations so this is one point microsoft made right if you are using both the policies for now you need to set this as zero then only it will work this is kind of a limitation or known issue for now okay okay so got it yeah thank you hey no worries man okay any other questions can we see the synchronization issues between microsoft update and the node the microsoft update and at the end endpoint this one a client you mean to say yes and all all those things are um like at the moment we need to go through the event logs as i mentioned or showed before right everything is those two event logs so if i go to event viewer everything is through this one right uh that device management event log for the policy configurations and windows update agent for the um the patches sync and everything right so you mean to say the sync like sscm okay so i got you so will find that you know the the download has been failed yeah so you you could see like i have shown you one 1909 download completed or something right in the event log yes so so same thing you can see yeah go ahead yeah uh like you know if at all if we have a chance to see if the downloads are getting failed and if we find out in the event viewer so how to tackle those situation okay so that's that's really a good question right so in sscm what we do normally right there could be some issues like uh ssu uh ssu is not updated probably that is why that is where we are not we are not getting um we are not getting the patches right so we need to update the ssu but in this world uh windows update for business world it is straightforward right this is everything is handled by windows update uh microsoft update or windows update from the cloud for business right so so it will handle automatically those kind of scenarios but if you can if you are talking about downloads right so downloads yeah again that is that is a generic kind of um uh kind of troubleshooting which you need to perform right so there could be some bits components involved in this so you might need to look into bits if i can show you bits i don't know where is it background intelligence background transfer yeah so you need to look into bits and you need to look into other other event logs to understand what is happening with bits and all right so you need to understand you need to troubleshoot in that way right so whether the bits download is happening or not what is failing why why bits is uh failing and if bits is failing you need to check whether bits are run bit service is running or not right so all these things services.msc all these things you need to check these are like general kind of troubleshooting you need to do whenever you have a issue like that right okay yeah okay [Music] from you uh in today's session so is that we need to pass quality updates for future updates to get installed it's not like that right you know probably i did i did say something wrong i don't know like but yeah that's not correct if i said that then that's not correct so we don't we don't have to post quality updates for uh posting feature updates i didn't hear you properly sorry yeah uh i didn't mean like you have told like that i didn't listen to that uh correctly so maybe i didn't get that correctly so then i want to clear it here anyways that's that's not a problem i i i can i can say wrong things many times so that's fine no and worries since we are uh learning real time uh things like policies and uh other even viewer things apart from gui uh this is uh very useful thanks for thanks for your session hey no worries man thank you that's my process okay any other questions otherwise we are going to stop for today and we will see something new tomorrow so on upon reporting uh you mentioned there is no default reporting but any other ways we can pull such reports to see the time i think i think i did mention about this documentation and where is it okay this one complains report right so see validation reporting windows 10 updates for so for in tune right so there's something like uh update compliancy and um oms also i don't know whether you have heard about uh azure log analytics and exam etc right so all these data should if you enable the telemetry right uh as per as per the documentation it should automatically get populated in your uh in your log analytics and update complaints right so from there you can get the reports you want but i just i just wanted to warn you it won't be similar experience as of scmsser ssrs reports right so you need to you need to kind of do a lot of configuration work etcetera etcetera etcetera to to complete to get the complete report okay does that make sense yep okay so if we don't have any other questions we are going to end the session for today and we'll see you tomorrow same time same place thank you all and enjoy your day rest of your day bye bye thank you bye you too you

Channel: Anoop C Nair

Views: 953

Keywords: Intune Windows 10 Update Ring Pause Options, Intune Windows 10 Update Ring Troubleshooting, Intune Windows 10 Feature Ring Troubleshooting, WUfB troubleshooting via Registry and Event Logs, Intune Windows 10 Update for Business Policies, Learn how to change Active hours from user's login, Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Update

Id: sY0F8P5_YSo

Length: 41min 9sec (2469 seconds)

Published: Tue May 19 2020