Americas

  • United States

Asia

sbradley
Contributing Writer

How do you want Microsoft updates — in ‘dribbles’ or all at once?

opinion
Feb 13, 20235 mins
MicrosoftMicrosoft 365Small and Medium Business

Change is coming to the way Microsoft updates Windows and various apps. Are you ready?

Microsoft is finally getting ready for software “dribbles.”

First announced last year (and expected last November), the company is set to unveil how IT admins can control incremental changes planned for Microsoft software and for Windows. The new mechanism, currently part of the Windows Insider release track, is slated to arrive with the March security updates. (It should also show up in the Windows 11 22H2 preview patch at the end of this month.)

The move is designed to meet the needs of IT pros unhappy with the pace of change in Windows 11. Change isn’t always wanted; instead, users and admins want to manage change on their own schedule.

Think about Office and Microsoft 365, where Microsoft lets IT administrators the choose a slower release channel (and thus, less change) in applications such as Word and Excel. With Microsoft 365, you can use the Microsoft 365 console or a deployment tool to specifically pick the release channel. I always find it ironic that Microsoft offers examples on how to move a device from the Semi-Annual Enterprise Channel to the Monthly Enterprise Channel, when in reality, we admins want exactly the opposite — the much slower and less disruptive Semi-Annual Enterprise Channel.

(As a reminder, to choose that slower channel, simply use a group policy or the Office deployment tool, or for a single machine, the command line.)

As for Windows itself, Microsoft has indicated it plans to dribble out revisions and changes throughout the year, rather than waiting for a feature release. But that can be disruptive for users, IT staffers, and patch management specialists — especially if you want to get ahead of any visual changes and manage user expectations.

Microsoft has been using “enablement packages” to ship changes to the operating system behind the scenes, according to Aria Carley in a Microsoft IT pro blog. Then when you install a feature release, these incremental changes can be turned on, ready to discover once your machine reboots after a feature release.

If you want to use these incremental changes along the way, you need to act to enable them. (They’re not exposed with each month’s security patches if you have “managed” machines controlled by Windows Update for Business or Windows Software Update Services.) So, you can test them, Microsoft is enabling a group policy or Intune policy setting:

Group Policy: /Windows Components/Windows Update/Manage end user experience/Enable features introduced via servicing that are off by default

Configuration Service Provider (CSP) Policy: /Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl

If you enable these policies, you can test out incremental changes before they arrive in the next feature release.

As noted in the blog, Microsoft will be specifically looking to ensure controls are in place that:

  • Add new experiences or user interfaces to Windows, especially for any primary control surfaces (such as the taskbar and start menu).
  • Are new in-box applications.
  • Remove existing capabilities.
  • Override previously configured settings (set by either IT or the end user).

The goal: ensure that end users and IT admins are not surprised by unexpected changes. In the past, some of these updates have been disruptive. For example, in Windows 10, the introduction of “news and interests” in the taskbar caused some early issues and required several tweaks before they were resolved. (Early releases triggered a blurry view on some video cards.) Other visual disruptions involved Search when Microsoft rolled out the little cartoon that highlights some news item in the search box.

I have often had to figure out how to adjust some of these settings or features in both Windows 10 as well as Windows 11, and the location of where to do so can be in slightly different places. So I often end up searching for how to turn something off. I’m glad Microsoft realizes we need choices to turn on, or off, as we see fit.

If you’re a small business or an at-home user — and don’t want changes dribbled out to you between each feature release — what do you do? If you use a group policy setting to control updates, and your system displays a message that “Some windows update settings are controlled by management” when you go into the Windows update interface on Windows 11 22H2, you will only get any incremental changes when the next feature release arrives. (If you don’t see that message, you should be able to use a registry setting; I’ll be testing that and verifying it in March when the code is installed on Windows 11 22H2.)

The bottom line is that Microsoft understands not everyone likes or wants changes. But for those who do want to test changes ahead of time, Microsoft encourages you to join the join the Microsoft Managed Customer Connection Program (MM CCP) feedback program. There you can offer guidance about how you want to see changes come to your workstations.

sbradley
Contributing Writer

Susan Bradley has been patching since before the Code Red/Nimda days and remembers exactly where she was when SQL slammer hit (trying to buy something on eBay and wondering why the Internet was so slow). She writes the Patch Watch column for Askwoody.com, is a moderator on the PatchManagement.org listserve, and writes a column of Windows security tips for CSOonline.com. In real life, she’s the IT wrangler at her firm, Tamiyasu, Smith, Horn and Braun, where she manages a fleet of Windows servers, Microsoft 365 deployments, Azure instances, desktops, a few Macs, several iPads, a few Surface devices, several iPhones and tries to keep patches up to date on all of them. In addition, she provides forensic computer investigations for the litigation consulting arm of the firm. She blogs at https://www.askwoody.com/tag/patch-lady-posts/ and is on twitter at @sbsdiva. She lurks on Twitter and Facebook, so if you are on Facebook with her, she really did read what you posted. She has a SANS/GSEC certification in security and prefers Heavy Duty Reynolds wrap for her tinfoil hat.