Windows client updates, channels, and tools

This article provides a summary of the kinds of Windows updates, the channels that serve them, and the tools for managing them.

Deploying

Deploying a modern version of Windows is simpler than previous versions of Windows. When migrating from earlier versions of Windows, use an easy in-place upgrade process to automatically preserve all apps, settings, and data. Afterwards, it's equally simple to deploy feature updates. To learn how to best plan, prepare, and deploy Windows, take the course Stay Current With Windows Devices And Microsoft 365 Apps.

Application compatibility

Application compatibility testing for desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved significantly compared to older versions of Windows. You should still test the most important business-critical applications to validate compatibility with new builds.

Servicing

Windows servicing includes different types of updates, servicing channels, and servicing tools.

How Windows updates work

The Windows update process has four phases:

  • Scan: A device checks the Microsoft Update server, Windows Update service, or your Windows Server Update Services (WSUS) endpoint at random intervals to see if any updates are available since the last time it checked. It then evaluates whether the update is appropriate by checking the policies that the administrator set up. This process is invisible to the user.
  • Download: Once the device determines that an update is available, it begins downloading the update. The download process is also invisible to the user. For feature updates, downloading happens in multiple sequential phases.
  • Install: After the update is downloaded, the device installs the update on the system, depending on the device's Windows Update settings.
  • Commit and restart: Once installed, the device usually (but not always) must be restarted to complete the installation and begin using the update. Before the device restarts, it is still running the previous version of the software.

Types of updates

Traditional Windows servicing includes several update types: major revisions or feature updates (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), monthly recommended security updates, and monthly optional updates. With Windows 10 and Windows 11, there are two overarching update types that you have the most control over:

Update type Definition Content & scope Delivery schedule Management
Quality updates Provide security and reliability fixes, and can periodically add new functionality or features. Cumulative monthly updates: supersede previous month's updates to prevent platform fragmentation. Combine security and non-security content. Include security, critical, servicing stack, and driver updates. Released on the second Tuesday of each month ("Patch Tuesday") for security updates, though out-of-band updates can be released at any time. Simplified maintenance: installing the latest update provides all available fixes for a feature update. Maximizes Microsoft testing coverage and reduces unexpected issues.
Feature updates Released annually to define the servicing timeline for the operating system. New capabilities: include new features and functionality. Bundle all previously released quality updates. Delivered once a year in smaller increments compared to legacy Windows versions. Easier management: deployable via existing management tools. Annual cadence (vs. legacy 3–5 year updates) reduces user readiness and management friction.

You might also hear about the following update types:

  • Servicing stack updates: The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates aren't necessarily included in every monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the component-based servicing stack (CBS), which is a key underlying component for several elements of Windows deployment, such as Deployment Image Servicing and Management (DISM), System File Checker (SFC), changing Windows features or roles, and repairing components. CBS is a small component that typically doesn't have updates released every month. You can find a list of servicing stack updates at Latest servicing stack updates. For more details about servicing stack updates, see Servicing stack updates.
  • Driver updates: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they're installed or not.
  • Microsoft product updates: These updates apply to other Microsoft products, such as Microsoft Office. You can use servicing tool policies to enable or disable Microsoft product updates.

Learn more about different update types.

Servicing channels

Servicing channels are the first way to separate users into deployment groups for feature and quality updates.

There are currently three servicing channels for Windows clients: the General Availability Channel, the Long-Term Servicing Channel (LTSC), and the Windows Insider Program. Each servicing channel provides different levels of flexibility when these updates reach client devices. Additionally, each channel can contain subsets of devices, which staggers servicing even further. Learn how to develop a deployment strategy that uses servicing channels in Prepare a servicing strategy for Windows client updates.

By using the different servicing channels, you can deploy Windows "as a service," which conceives of deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise, without interrupting the entire process.

The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel by using several tools, including Microsoft Intune, Microsoft Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means.

By dividing devices into different populations ("deployment groups" or "rings"), you can create a phased deployment of any update. Deployment rings are groups of devices used to initially pilot and then broadly deploy each feature update in an organization. Start deployment with devices selected for early adoption, monitor anomalies, errors, or user impact, and gradually expand deployment to additional devices as appropriate.

The following table shows the servicing channels available for each edition.

Edition General Availability Channel Insider Program Long-Term Servicing Channel
Home Yes No No
Pro Yes Yes No
Enterprise Yes Yes No
Enterprise LTSC No No Yes
Pro Education Yes Yes No
Education Yes Yes No

General Availability Channel

The General Availability Channel is the default servicing channel for all Windows devices except those with the LTSC edition installed.

In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing feature updates. Consider it for users such as information workers and developers who need to work with the latest features. After the latest release goes through pilot deployment and testing, you can choose when to begin broad deployment.

When Microsoft officially releases a feature update, it's typically available for immediate installation. As long as a device isn't set to defer feature updates, any device in this channel installs a feature update as soon as it's released.

Organizations that use Windows Server Update Services (WSUS) or Microsoft Configuration Manager can defer feature updates to selected devices by withholding approval and deployment. Organizations that use Windows Update client policies can configure feature update deferrals or a target version policy instead. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. If you use Windows Update client policies, the channel provides three months of additional total deployment time before being required to update to the next release. You can delay or gradually deploy feature updates into as many phases as you wish by using servicing tools. For more information, see Servicing tools.

Important

Devices on the General Availability Channel must have their diagnostic data set at least to (1) Basic to help ensure that the service performs at the expected quality. For instructions, see Configure Windows diagnostic data in your organization.

Long-Term Servicing Channel

The Long-Term Servicing Channel isn't intended for most or all the devices in an organization. Use it only for special-purpose devices. Such devices control medical equipment, point-of-sale systems, and ATMs. Since these devices typically perform a single important task, they don't need feature updates as frequently as other devices in the organization. It's more important to keep these devices as stable and secure as possible than up to date with user interface changes. As a general guideline, a device with Microsoft Office installed is a general-purpose device. General-purpose devices are better suited for the General Availability Channel.

The LTSC servicing model prevents Enterprise LTSC devices from receiving the usual feature updates. It provides only quality updates to help ensure that device security stays up to date. While quality updates are still immediately available to Windows 10 and 11 Enterprise LTSC clients, you can choose to defer them by using one of the servicing tools below.

Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSC. Instead, it typically offers new LTSC releases every 2–3 years. Organizations can choose to install these updates as in-place upgrades or skip them during the product's lifecycle. Always check your individual LTSC release to verify its servicing lifecycle. For more information, see release information. Alternatively, search the product's lifecycle information page.

Note

LTSC releases support the currently released processors and chipsets at the beginning of their lifecycle. As newer CPU generations are released, you can deploy newer LTSC releases to support them. For more information, see Supporting the latest processor and chipsets on Windows in Lifecycle support policy FAQ - Windows products.

The Long-Term Servicing Channel is available only in the Windows Enterprise LTSC editions. They often omit such applications as Microsoft Edge, Microsoft Store, Microsoft Outlook, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps aren't supported in the Enterprise LTSC editions, even if you install them by using sideloading. LTSC releases are only available through the Microsoft Volume Licensing Center.

Windows Insider Program

The Windows Insider Program provides organizations with the opportunity to test and provide feedback on upcoming features.

For many IT pros, early visibility into feature updates is valuable for planning user communications and testing for issues before the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and your organization. It's an opportunity to discover and report possible issues before the update is ever publicly available.

Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are options within the Windows Insider Program for Business channel:

  • Windows Insider Experimental (previously, Dev)
  • Windows Insider Beta
  • Windows Insider Release Preview

Use the Windows Insider Release Preview channel for validation activities.

All organizations should have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, see Windows Insider Program for Business.

Servicing tools

You can use many tools to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following tools help you manage Windows updates.

General tools

  • Windows Update (standalone) provides limited control over feature updates. IT pros can manually configure the device to be in the General Availability Channel. To defer updates on specific devices, select the Defer upgrades check box in Start > Settings > Update & Security > Advanced Options on a Windows client device.

Tools for cloud-based update delivery

  • Windows Update client policies include control over update deferment and provide centralized management. Depending on the version, Windows Update client policies can defer updates by up to 365 days. Client devices in the General Availability Channel have these deployment options. You can manage Windows Update client policies by using Group Policy or Microsoft Intune as mobile device management (MDM) without requiring any on-premises infrastructure.
  • Microsoft Intune and Windows Autopatch. Your individual devices connect to Microsoft endpoints directly to get the updates. You set the details of this process on devices by using Group Policy or MDM policies. You control these policies by using any of several tools:

Tools for on-premises update delivery

You can set up, control, and manage the server and update process by using several tools:

  • Windows Server Update Services (WSUS) provides extensive control over updates and is natively available in the Windows Server operating system. Use it to defer updates or add an approval layer to deploy updates to specific computers or groups of computers when the organization is ready. A standalone Windows Server Update Services server operated directly: you set up a WSUS server, which downloads updates in bulk from Microsoft. Your individual devices then connect to your server to install their updates from there. For more information, see Windows Server Update Services (WSUS).
  • Microsoft Configuration Manager provides the greatest control over servicing Windows as a service on premises. Defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times.
  • Non-Microsoft tools

Tools for hybrid scenarios

You can also combine WSUS-based on-premises update distribution with cloud-based update delivery.

Choose the servicing tools based on whether you can defer and approve updates and what other features they include, such as bandwidth considerations.

Servicing tool Can you defer updates? Ability to approve updates Peer-to-peer (P2P) option Additional features
Windows Update Yes (manual) No Delivery Optimization P2P and Microsoft Connected Cache None
Windows Update client policies Yes No Delivery Optimization P2P and Microsoft Connected Cache Other Group Policy objects
WSUS Yes Yes Delivery Optimization P2P and Microsoft Connected Cache Upstream/downstream server scalability
Microsoft Intune Yes Yes for all updates delivered via Windows Autopatch Delivery Optimization P2P and Microsoft Connected Cache Cloud-based management, policy deployment, and mobile device management (MDM) integration.

Peer-to-peer distribution

Microsoft Connected Cache and Delivery Optimization can help distribute feature update installation files between devices.

  • Laatst bijgewerkt om