Integrate Windows Update for Business with management solutions

Applies to

  • Windows 10
  • Windows 10 Mobile

Looking for consumer information? See Windows Update: FAQ

You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager.

Integrate Windows Update for Business with Windows Server Update Services

For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup:

  • Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy
  • All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows will not follow your Windows Update for Business deferral policies

Configuration example #1: Deferring Windows Update updates with other update content hosted on WSUS

Configuration:

  • Device is configured to defer Windows Quality Updates using Windows Update for Business
  • Device is also configured to be managed by WSUS
  • Device is not configured to enable Microsoft Update (Update/AllowMUUpdateService = not enabled)
  • Admin has opted to put updates to Office and other products on WSUS
  • Admin has also put 3rd party drivers on WSUS
ContentMetadata sourcePayload sourceDeferred?
Updates to WindowsWindows UpdateWindows UpdateYesdiagram of content flow
Updates to Office and other productsWSUSWSUSNo
Third-party driversWSUSWSUSNo

Configuration example #2: Excluding drivers from Windows Quality Updates using Windows Update for Business

Configuration:

  • Device is configured to defer Windows Quality Updates and to exclude drivers from Windows Update Quality Updates (ExcludeWUDriversInQualityUpdate = enabled)
  • Device is also configured to be managed by WSUS
  • Admin has opted to put Windows Update drivers on WSUS
ContentMetadata sourcePayload sourceDeferred?
Updates to Windows (excluding drivers)Windows UpdateWindows UpdateYesdiagram of content flow
Updates to Office and other productsWSUSWSUSNo
DriversWSUSWSUSNo

Configuration example #3: Device configured to receive Microsoft updates

Configuration:

  • Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS
  • Device is configured to “receive updates for other Microsoft products” along with updates to Windows (Update/AllowMUUpdateService = enabled)
  • Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server

In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled.

  • In a non-WSUS case, these updates would be deferred just as any update to Windows would be.
  • However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied.
ContentMetadata sourcePayload sourceDeferred?
Updates to Windows (excluding drivers)Microsoft UpdateMicrosoft UpdateYesdiagram of content flow
Updates to Office and other productsMicrosoft UpdateMicrosoft UpdateNo
Drivers, third-party applicationsWSUSWSUSNo

Note

Because the admin enabled Update/AllowMUUpdateService, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner.

Integrate Windows Update for Business with System Center Configuration Manager

For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of Unknown.

Example of unknown devices