question

PekkaPekkonen-2967 avatar image
0 Votes"
PekkaPekkonen-2967 asked PekkaPekkonen-2967 commented

Intune update ring does not deploy feature update

Hello

I have a update ring through Intune. The problem is with feature updates. There are several 1909 computers.

I have the following setting in Intune.
89546-kuva-20-04-21-14-57-50.jpg



What could cause feature version not update?

Regards,
Pekka Pek

mem-intune-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PekkaPekkonen-2967 avatar image
0 Votes"
PekkaPekkonen-2967 answered PekkaPekkonen-2967 commented

Hello after a while

It turned out that we can get around the issue. My collegue found out that there is a command line command or Powershell command with Windows update assistant.

That command appeared to work even if Intune was unable to feature update. That way we should be able to update several computers without end user contacting.

Regards,
Pekka

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Without knowing details here, it's difficult to say anything definitive, but the above statement honestly makes no sense. Intune does not deploy feature updates. It merely configured WUfB policies that control how and when the Windows Update client on the system downloads and installs updates. There is no other way to install updates except to use the Windows Update client. Perhaps what you ran corrected an issue with the WU client -- as noted, without knowing exactly what was done though, not much else can be said.

0 Votes 0 ·

Thank you for the information about technical background.

Myself I haven't had the possibility to confirm this behavior but I'm sure we can trust this observation of experienced colleague of mine.

Based on that, I also think that Windows update assistant runs some fixes in the background that solves the update issue.

0 Votes 0 ·
AjayMahajan-4387 avatar image
0 Votes"
AjayMahajan-4387 answered AjayMahajan-4387 commented

Hi @PekkaPekkonen-2967, is your device/devices are Azure AD joined or Hybrid ?

you might want to check whether this configuration policy has been applied or it is showing "not applicable", if it is hybrid then you might need to enable Co-management for applying policies via Intune on hybrid joined Devices.

first please check Device status.

Thanks
Ajay

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

if it is hybrid then you might need to enable Co-management for applying policies via Intune on hybrid joined Devices.

This is not correct unless the device is also managed using ConfigMgr. Hybrid AAD joined in no way implies co-management is required for any purpose. Co-management is about managing Win 10 devices with both ConfigMgr and Intune. If there is no ConfigMgr, then co-management is irrelevant.

0 Votes 0 ·

@Jason-MSFT - thanks for the clarification.

0 Votes 0 ·
Jason-MSFT avatar image
0 Votes"
Jason-MSFT answered Jason-MSFT edited

Definitely check the device status in the Intune console to validate that the systems in question are receiving the profile/policy (as noted by AjayMahajan-4387).

A possible problem for these systems is that they are subject to a safeguard hold. To determine this, you need to configure update compliance: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/access-safeguard-hold-details-with-update-compliance/ba-p/1809652

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Crystal-MSFT avatar image
0 Votes"
Crystal-MSFT answered Crystal-MSFT edited

@PekkaPekkonen-2967 For this issue, we can firstly check whether the update ring policy has been successfully deployed to the target device. We can see details in the following link:
https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-troubleshooting-windows-10-update-ring-policies/ba-p/714046

If the policy is applied, we can consider to use Update Compliance policy which mentioned in the link Jason provided to troubleshoot our issue:
https://docs.microsoft.com/en-us/mem/intune/protect/windows-update-compliance-reports#use-update-compliance

Hope it can help.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PekkaPekkonen-2967 avatar image
0 Votes"
PekkaPekkonen-2967 answered Crystal-MSFT commented

Thank you all for the replies. I hope I can cover below the points you had.

  1. Is the environment hybrid

The join should be Azure AD only.
I took following screen shot from Azure AD.
89842-kuva-21-04-21-11-36-33.jpg

  1. Device status

I took one computer with issues. Seems it shows success.
89892-image.png

  1. Feature update failures

This is new feature for me. It shows that there is no failures.
89818-kuva-21-04-21-11-17-43.jpg



Regards,
Pekka


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@PekkaPekkonen-2967 Thanks for your reply. From the pictures I noticed that the policy deployment status is succeeded, it means our Windows Update Ring policy is being successfully deployed. We can double confirm by checking the Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Update If the registry keys are correct, I wonder the issue can be with windows update side. For update compliance, could you confirm if we have added Update Compliance to our Azure subscription?

As another option, we can check the windows update log to see if there’s any finding. After researching, I find a link for your reference:
https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-logs

However, if the issue still persists, we suggest to open case to get more help.
https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

0 Votes 0 ·
Jason-MSFT avatar image
0 Votes"
Jason-MSFT answered Crystal-MSFT commented

As noted, the domain join state is irrelevant here.

Have you deployed update compliance to validate that there isn't a safeguard hold on the systems in question?

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Ah, I missed that note. Good to know.

Also now I found how to deploy update compliance. I will come back to that after I have got approval to create Log Analytics Workspace.

0 Votes 0 ·

@PekkaPekkonen-2967 Thanks for the reply. I notice we are waiting for the Log Analytics Workspace. approval. If there's any update, feel free to post back.

0 Votes 0 ·

I got aproval to create update compliance. Unfortunately it seemed to fail, no content seem to be uploaded.

91173-kuva-26-04-21-09-12-11.jpg

The error I got might be the reason.

91118-image.png

I set up according to this blog post.
I will come back to the original issue if I get this solved.


0 Votes 0 ·
image.png (76.2 KiB)

@PekkaPekkonen-2967 Thanks for the reply. I know we are working on the update compliance issue and will post back after the issue resolved. We will wait here. If there's any update after the update compliance issue is fixed, feel free to let us know.

0 Votes 0 ·