Every second Tuesday, Microsoft releases security updates. The attackers reverse-engineer them within hours to create exploits for unpatched systems (Exploit Wednesday). Windows Server Update Services (WSUS) and Windows Update for Business (WUfB) give you the tools to automate patch deployment with ring-based testing. This lesson covers building a patch management architecture that ensures critical updates are deployed quickly while minimizing business disruption.
WSUS downloads updates from Microsoft and allows you to approve them for groups of computers. Create computer groups (Pilot, Production1, Production2) and approve updates to Pilot first. After testing, approve to broader rings. Use 'deadlines' to enforce installation by a certain date. WSUS also provides reporting on compliance. However, WSUS can be clunky; many organizations supplement with third-party tools or move to WUfB with Intune.
This registry output confirms the client is pointing to your WSUS server, not Microsoft directly.
WUfB shifts patching to a cloud-managed model using ring-based deferral and deadline policies. You configure quality update deferral (e.g., 0 days for Pilot, 7 days for Broad), feature update deferral, and automatic update behavior. Intune provides compliance reporting. WUfB eliminates the need to manage a WSUS server and integrates with Microsoft's delivery optimization for peer-to-peer distribution.
# Check update ring policies applied via Intune
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" | Select BranchReadinessLevel, DeferFeatureUpdatesPeriodInDays, DeferQualityUpdatesPeriodInDays💡 Use 'Update Compliance' (now part of Azure Monitor) to gain insight into update status across your fleet, including which devices are missing critical security updates.
| Feature | WSUS | WUfB |
|---|---|---|
| Deployment model | On-premises server | Cloud-managed (Intune/MDM) |
| Approval control | Manual or auto-approval rules | Ring-based deferral policies |
| Reporting | WSUS console + SQL | Azure Update Compliance, Intune reports |
| Ideal for | Highly regulated environments | Modern, cloud-native enterprises |
Occasionally, Microsoft releases out-of-band updates for critical zero-days. Your process must support accelerating these updates through the rings. In WSUS, approve immediately with a short deadline. In WUfB, create a policy override that sets deferral to 0 days. Always have a rollback plan: test the update on a canary machine first; if it breaks, you can uninstall (for quality updates) or defer further.
⚠️ Delaying security updates by 30 days is common in conservative environments, but this puts you at significant risk. Use compensating controls like exploit protection if you must delay.
Verify exercises to earn ★ 150 XP and unlock next lab level.