If you are trying to decide what Products to include in your WSUS settings, this is the article for you. SCOM and WSUS currently have a dozen Windows 10 “products” listed but the descriptions are useless. After several hours of reading and asking Microsoft Partner Support about the various settings, this is what I have deduced:
- Windows 10 and Later Drivers: These are drivers that will be offered to all builds of Windows 10 all the time, excluding upgrade scenarios (i.e., via Orchestrator, DSM, or Device Manager). They will not download during a Dynamic Update (i.e. Windows 10 upgrading itself from build 1511 to 1607). They should only include KBs for the current Win10 version.
. - Windows 10 and Later Upgrade & Servicing Drivers: These are drivers that are offered in all Win10 scenarios (i.e., via Orchestrator, DSM, Device Manager, or during DU). They may include some KBs later win10 version and enable current win10 version to upgrade.
. - Windows 10 Anniversary Update and Later Servicing Drivers: These drivers apply only to Windows 10 1607 Anniversary and will not contain later upgrade. It also includes servicing drivers as “Windows 10 and later upgrade & Servicing drivers”
. - Windows 10 Anniversary Update Server and Later Servicing Drivers: These drivers apply only to what is now named Windows Server 2016 and will not contain later upgrade. It also includes servicing drivers as “Windows 10 and later upgrade & Servicing drivers”
. - Windows 10 Dynamic Update: This includes only updates to the setup process that occurs when one build of Windows 10 is trying to update to a new build of Windows 10 (i.e. 1511 to 1607).
. - Windows 10 Features On Demand: This loads the items listed on any Windows 10 PC’s PROGRAMS AND FEATURES > TURN WINDOWS FEATURES ON AND OFF into the WSUS server. That would mean that when a .NET 3.5 install is required on a Windows 10 PC, it will pull the files from the WSUS server rather than making you install it via command line using a Windows 10 DVD to solve errors 0x800F0906 and 0x800F081F
. - Windows 10 GDR-DU LP: GDR = General Distribution Release, DU=Dynamic Update, LP = Language Packs. These updates are to Languages used by the current release version of Windows 10 (in December 2016 that is build 1607) during a Dynamic Update (see item 5 above).
. - Windows 10 GDR-DU: GDR = General Distribution Release, DU=Dynamic Update. These updates are only used by the current GDR build of Windows 10 when it is trying to perform a Dynamic Update (see item 5 above).
. - Windows 10 Language Interface Packs: Windows Language Interface Pack (LIP) is a high-quality, localized “skin” for emerging or minority language markets. LIP provides the desktop user with an approximately 80% localized user experience by translating a reduced set of user interface (UI) elements. LIP has a dependency on a base Language Pack of Windows. Languages are offered as a LIP or a LP depend on the level of investment Microsoft has in a specific country/region. It is possible for a LIP market to grow into a LP market between the current and future Windows rollout. See THIS article for more details on LIP and LP’s.
. - Windows 10 Language Packs: Language Packs contain full blown languages. Remember that at it’s core Windows 10 is language agnostic. It comes with no default language and one has to be loaded for it to function.
. - Windows 10 LTSB: LTSB = Long Term Servicing Branch. Updates in this category are for a special long life version of Windows 10 that is promised to exist for 10 years with minimal updates. See THIS for more details on Windows 10 LTSB.
. - Windows 10: These are the standard release patches that are may apply to any or all builds of Windows 10. Each one of these updates will have a KBase article for them.
In addition to the assistance of “Sherry” from MS Partner Support on this thread, I also found the following articles useful and you might too:
General vs Limited vs Quick Fix Patch Releases
Differences between GDR, LDR and QFE
SOLVED: Cannot Install .NET 3.5 On Windows 10 Error 0x800F0906 and 0x800F081F
Dynamic Update Communication Explained
Windows 10 LTSB
What is Missing from the Long Term Servicing Branch (LTSB) Version of Windows 10
Language Interface Packs vs Language Packs
Date Created: Apr 06, 2022 (UTC)
Last Updated: Nov 21, 2023 (UTC)
Have you ever wanted to know which Configuration Manager Software Update Point (SUP)/WSUS products you should enable so your devices receive all available patches?
An easy way, but definitely not recommended, would be to enable all products. This is a bad idea as workstations would have to download a large amount of metadata and that would impact the scanning process.
Before today, there was no easy way to identify which products to select. You could go through all of the software titles in your environment, and then try and figure out which products they match to. Or you could just know your environment well enough to know which ones to select.
As an Architect for a global MSP, I routinely go into environments I have no knowledge of. Verifying they have all the required products selected is a task I cannot do without extensive data gathering. I searched the internet looking for an easy way to identify which products should be selected, but found none. I even posted in online forums, but no one was able to provide an answer.
After doing some more research, I devised a PowerShell script that can identify which products each device needs updates for.
Using the Microsoft.Update.Searcher COM object, the PowerShell script goes online and scans directly against Microsoft Update.
NOTE: The script DOES NOT install any updates it detects, it just scans for them.
The results of the scan are then parsed and the products related to the updates Microsoft identified are captured. Optionally, the results will be loaded into a custom WMI class so they can be inventoried by MECM/SCCM. By default, the WMI class is called Update_Product_List and it is found under the ROOT\ITLocal namespace
Update Nov 21, 2023: Additional logic has been added to the script to work around an issue introduced by the ‘Specify source service for specific classes of Windows Update’ GPO setting. That GPO caused no results to be returned by the query if the source was set to Windows Server Update Services.
Once the Hardware Inventory classes are extended to inventory this information (not detailed here), you can report against those metrics. I created a report that compares the products devices have installed, with what is selected on the Products tab of the SUP. I’ve included the report, along with the script, in the download at the end of this post.
The report is Collection based, and will only show products that pertain to the devices in the collection. This way you can make sure your ADR’s have all of the products selected for the devices you are targeting, and not have them scan for products that the devices don’t have installed.
You may also see Windows versions and Products that are not in your environment. For example, in my lab, it is showing ‘Windows 10 LTSB’ as a product found on a device, but in reality, I do not have LTSB installed anywhere. What is happening here is that some updates, like the monthly CU, apply to multiple products, and all of those products will be included by the scan.
At this point it is important to point out what needs to be enabled for the script to work.
The devices MUST be able to communicate with Windows Update (download.windowsupdate.com) to get metadata. If your company blocks access, then the script won’t work.
You can check if you can communicate with Windows Update by going into Settings and clicking on Update and Security. If you see the link ‘Check online for updates from Microsoft Update.’ you should be good to go.
If you do not see the link, more than likely it is being blocked by the following GPO setting
Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings
Turn off access to all Windows Update features = Enabled
The script also requires that ‘Give me updates for other Microsoft products when I update Windows’ under Advanced Options is enabled.
No worries if that option is not enabled. The script will turn it on if it is not enabled, and then turn it back off when done scanning. If it is already enabled, the script will not touch the setting.
The script creates the following three files in C:\Windows\CCM\Logs.
- Get-UpdateProductList.log — The log file for the script itself
- UpdateProductListScanResults.csv — A list of all the updates Microsoft identified that were applicable to your device. It includes whether they are installed or not and what product categories they belong to.
- UpdateProductListProductsFound.txt — Contains a distinct list of products that were found. This is the information that is loaded into WMI.
During my testing I noticed that ‘Microsoft Edge’ was not reported by any device. I’m assuming this is because Microsoft Update doesn’t scan for that since Edge updates itself.
Note: If you use the script to identify which products to unselect, keep in mind that not all products in WSUS may be scanned against Microsoft Update. Before unselecting a product, filter by the product in the ConfigMgr console and if any update shows Required or Installed, don’t unselect it.
As always, test, test, test before putting into production.
Download: GetUpdateProductList.zip
THE SOFTWARE IS PROVIDED «AS IS», WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Comments:
Комментировать
Подписаться
3
Простой
Комментировать
Пригласить эксперта
Ответы на вопрос 2
А если пустить мимо WSUS и глянуть, что она хочет качнуть?
Комментировать
@necroic
Системный администратор
Возможно кому-то пригодится, на целевой системе я запускаю Windows Update Mini Tool, делаю поиск обнов с портала Microsoft Update и там, под каждой найденной необходимой обновой, будет указано, для какого она продукта.
Комментировать
Ваш ответ на вопрос
Войдите, чтобы написать ответ
Похожие вопросы
-
Показать ещё
Загружается…
Минуточку внимания
Реклама
Windows 10: Products and Classification selection for Windows 10 versions in WSUS
Discus and support Products and Classification selection for Windows 10 versions in WSUS in Windows 10 Installation and Upgrade to solve the problem; We are using WSUS to deploy MS critical and security patches to Windows machines in our environment. With Windows 10 we are having trouble getting…
Discussion in ‘Windows 10 Installation and Upgrade’ started by Sitaram Nayak, Jul 23, 2019.
-
Products and Classification selection for Windows 10 versions in WSUS
We are using WSUS to deploy MS critical and security patches to Windows machines in our environment. With Windows 10 we are having trouble getting patches from WSUS. I am not sure if I have missed any selection in products and classification. Can someone guide me the right selections so that Windows 10 Pro versions receive the monthly patches from WSUS?
We have mixed of Windows 10 Pro 1703, 1709, 1803, 1903 machines.
Currently I have selected below products.
Windows 10 and later drivers
Windows 10 and later upgrade & servicing drivers
Windows 10, version 1903 and later
Windows 10
Thanks & Regards
Sitaram
-
WSUS updates and defender definition updates problem with W10 LTBS 1607
Hello,
Environment
A number of windows 10 PRO are running and WSUS properly provides updates for them.
Recently a number of Dell 5070 WES clients with preinstalled W10 IOT (current version is W10 LTBS 1607 Enterprise edition) have been deployed.
Settings for WSUS
In products list:
In addition to other W10 editions selected W10, W10 LTBS and a number of other versions. I also selected Windows Defender.
In classification:
Selected Critical Updates, Definition Updates, Security Updates, Service Packs, Updates Rollups, Upgrades.
Definitions updates are set to be automatically approved.
W10 LTBS updates and definitions
WSUS recognizes Wyse 5070 devices as Windows 10 Enterprise 2016 LTBS but It does not show any current failed/needed updates for these devices Defender defenitions updates are not being deployed.
Online updates with Microsoft does work: patches/updates can be downloaded and installed and defender definitions are applied automatically.
-
Windows 10 Tweaks
Pressing “Windows+Pause Break” (it’s up there next to scroll lock) opens the “System” Window.
Windows 10: In the new version of Windows, Explorer has a section called Quick Access. This includes your frequent folders and recent files. Explorer defaults to opening this page when you open a new window. If you’d rather open the usual This PC, with links to your drives and library folders, follow these steps:
- Open a new Explorer window.
- Click View in the ribbon.
- Click Options.
- Under General, next to “Open File Explorer to:” choose “This PC.”
- Click OK
credit to Lifehacker.
-
Products and Classification selection for Windows 10 versions in WSUS
Products and Classification selection for Windows 10 versions in WSUS
-
Products and Classification selection for Windows 10 versions in WSUS — Similar Threads — Products Classification selection
-
WSUS cannot show latest version of Windows
in Windows 10 Installation and Upgrade
WSUS cannot show latest version of Windows: Hi all,I have a WSUS Server, It still running normally but cannot show latest version of Windows. Example attach file: this machine has been upgrade from Windows 10 Pro version 1903 to Windows 10 Pro version 22H2 but the WSUS Server only show build number 19041 2004. It makes… -
WSUS Downstream Servers — Not Sync’ing Classifications everything else fine
in Windows 10 Software and Apps
WSUS Downstream Servers — Not Sync’ing Classifications everything else fine: I have a strange situation wherein I have a primary SUS server and two downstream SUS servers. All synchronisation / connectivity is functioning fine. The only oddity is that ‘Classifications’ are not syncing correctly. Upstream is configured for Critical Updates, Definition… -
WSUS Downstream Servers — Not Sync’ing Classifications everything else fine
in Windows 10 Gaming
WSUS Downstream Servers — Not Sync’ing Classifications everything else fine: I have a strange situation wherein I have a primary SUS server and two downstream SUS servers. All synchronisation / connectivity is functioning fine. The only oddity is that ‘Classifications’ are not syncing correctly. Upstream is configured for Critical Updates, Definition… -
classification of a question
in Windows 10 Gaming
classification of a question: I cannot make up my mind which category my questions fit into. I have a collection of problems which all fit loosely into Windows 10 because that is the operating system I have. But they boil down to confusions concerning User Accounts. I have asked a question but cannot find… -
classification of a question
in Windows 10 Software and Apps
classification of a question: I cannot make up my mind which category my questions fit into. I have a collection of problems which all fit loosely into Windows 10 because that is the operating system I have. But they boil down to confusions concerning User Accounts. I have asked a question but cannot find… -
Windows Product Key Classification
in Windows 10 Updates and Activation
Windows Product Key Classification: Hi all,I cannot turn on my laptop due to an issue on disk so the device shuts down quickly.
My question is I have windows product key sticker at least and I hope to use this one in a fresh installation.
But the problem is Im not sure if this license works on a different… -
WSUS and Windows 10
in Windows 10 Installation and Upgrade
WSUS and Windows 10: HelloI’m using a GPO to control when patches are applied to my PC’s. When I go and check the W10 PCs, I select check for updates, it shows a «Retry» button and when I hit «Retry» it downloads and installs the patches, no problem. This is consistent with all W10 PC’s….
-
Windows 10 version 1809 and WSUS without internet connection
in Windows 10 Installation and Upgrade
Windows 10 version 1809 and WSUS without internet connection: I’ve been building a test laboratory to try out Windows 10 version 1809 with Windows Server 2019 and I’ve come across an issue.When I configure the clients to connect to WSUS for updating, they won’t connect and scan if they don’t have an internet connection. I’m testing…
-
WSUS Client cannot install Windows 10 version 1803.
in Windows 10 Installation and Upgrade
WSUS Client cannot install Windows 10 version 1803.: Hi All,Hope someone can help me with my current issue. All my client machines are getting the error message below and can’t install the Windows 10 version 1803.
Feature update to Windows 10 (consumer editions), version 1803, en-us
Event reported at 2/08/2018 12:08 a.m.:…
Users found this page by searching for:
-
windows 10 products and classifications
,
-
what products and classifacations should be selected in wsus for win 10
,
-
windows 10 selections for wsus
,
- what type of classification need to be select in wsus,
- wsus products under products and classification versions of windows definitions,
- 10 enterprise upgrading to 1903 via wsus