How do I choose the updates I want to install?

Question

Hi,

In the past until Windows Server 2012 we were able to choose the updates we wanted to install by selecting the checkbox.

I think from 2016 onwards we do the search and automatically everything that Microsoft decides to install is installed.

Recently we are participating in some incompatibilities with windows updates and I want to know if it is possible to select what we want to be installed.

For example:

Case 1

During the update process some VMware update was installed where the server lost network connectivity, but we didn't know that Windows would download these updates.

Case 2

During the update process KB501466 was installed which to my surprise is not security, but I swore that Windows Update only installed security updates unless I chose any of the advanced options.

Given these scenarios, what solutions can I apply to prevent this from happening in the manual process where I don't have a WSUS?

Below are my current Windows Update settings:

Thanks.

Answer 1

KB5014669 Is a cumulative update preview. Yes a rollup contains both security and non-security updates.
https://www.catalog.update.microsoft.com/Search.aspx?q=KB5014669

as far as preventing them; the best way may be to have your own WSUS at site where you can review and approve them.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

The short answer is you don't unless you choose security only updates.
https://support.microsoft.com/en-us/topic/windows-8-1-and-windows-server-2012-r2-update-history-47d81dd2-6804-b6ae-4112-20089467c7a6

Security-only update
An update that collects all the new security updates for a given month and for a given product, addressing security-related vulnerabilities. It's distributed through Windows Server Update Services (WSUS), System Center Configuration Manager and Microsoft Update Catalog. Security vulnerabilities are rated by their severity. The severity rating is indicated in the Microsoft security bulletin as critical, important, moderate, or low. This Security-only update would be displayed under the title Security Only Quality Update when you download or install the update. It will be classified as an Important update.

Monthly Rollup
The Monthly Rollup is product-specific and addresses both new security issues and nonsecurity issues in a single update. It will proactively include updates that were released in the past. Security vulnerabilities are rated by their severity. The severity rating is indicated in the Microsoft security bulletin as critical, important, moderate, or low. This Monthly Rollup would be displayed under the title Security Monthly Quality Rollup when you download or install. This Monthly Rollup will be classified as an Important update on Windows Update. It will automatically download and install if your Windows Update settings are configured to automatically download and install Important updates.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Manual approval on a WSUS server is the only way. Realistically it doesn't take much effort each month to review them - 5-15 minutes per month to review and approve to a test group, and then to production a few days later after your 'testing-in-production' test systems are showing no signs of issues.

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-1-choosing-your-server-os/