Deferring and Delaying Updates
The level of control that administrators have over how and when updates are installed on a device depends on which edition of Windows is installed on that device. Note that the following rules apply to public releases of Windows 10 and are not applicable to Insider Preview builds:
- On devices running Windows 10 Home, all updates are delivered automatically on a schedule defined by Microsoft's update servers. No options to defer updates are available on this edition, although you can pause updates for up to 35 days. You don't need to take any additional action aside from observing the occasional reminders to restart your computer and, if you choose, to schedule a restart.
- On devices running Windows 10 Pro, Enterprise, and Education, the default settings are the same as those in Windows 10 Home. As an administrator, however, you can take advantage of additional options collectively known as Windows Update for Business. These controls, available as part of Group Policy, allow you to delay installation of quality updates by up to 30 days after they are initially available from Microsoft and to defer installation of feature updates by up to 365 additional days.
- Organizations with a Volume License agreement for Windows have one additional option: They can choose to purchase and install Windows 10 Enterprise LTSC/LTSB, which is a part of the Long Term Servicing Channel (formerly the Long Term Servicing Branch). This edition offers 10 years of support and receives no feature updates.
In versions of Windows 10 before version 2004, these Windows Update for Business settings are available on the Settings → Update & Security → Windows Update → Advanced Options page, under the Choose When Updates Are Installed heading. By adjusting settings here, administrators of devices running Windows 10 Pro, Education, and Enterprise editions can defer installation of quality updates and delay offers to install feature updates. Effective with version 2004, these options have been removed from Settings and are available only via Group Policy settings, as we explain later in this section.
The first option under the Choose When Updates Are Installed heading allows you to defer feature updates by an additional period of up to 365 days from the time they are made publicly available. We have set a deferral of 60 days. This has the practical effect of delaying a feature update until the first two monthly cumulative updates are available. Note, however, that selecting a lengthy update period here might not have the intended effect. If the deferral period extends past the end-of-support date for the currently installed version, Windows Update will ignore the deferral period and offer the feature update with a notice that it must be installed to continue receiving quality updates.
The second option allows deferral of quality updates-the cumulative updates that include security and reliability enhancements-by up to 30 days. Selecting a deferral of 7 days, effectively gives you a week to monitor feedback from Microsoft support channels after the regular release of updates on the second Tuesday of each month. If you discover a problem that might affect your PC, you can use the Pause Updates option to delay installation further while you either find a workaround or wait for Microsoft to resolve the issue.
Both deferral settings are persistent.
If you need to pause updates for only a period of time-for example, if you plan to be traveling and don't want to be bothered with the update process-use the Pause Updates control here. Windows Update will refrain from updating your system for up to 35 days or until you click Resume Updates.
As we noted earlier, as of Windows 10 version 2004, you must apply Windows Update for Business settings using Group Policy, either as part of a Windows domain using Active Directory or using the Local Group Policy Editor, Gpedit.msc. These policy settings are available in Computer Configuration → Administrative Templates → Windows Components → Windows Update → Windows Update For Business.
The four policies available for configuration are as follows:
- Select When Preview Builds And Feature Updates Are Received Configure this policy to defer feature updates. After you enable this policy, you can
select the "Windows readiness level" that corresponds to the servicing channel. For public releases, the Semi-Annual Channel option is the correct choice; this policy
also allows you to choose one of three Insider Preview channels. You can then specify an amount of time to defer the update after release. This value is entered in
days, with possible values ranging from 0 to 365.
- Select When Quality Updates Are Received With this policy, you can defer the regular cumulative updates (which include security, reliability, and driver
updates) for up to 30 days. Deferring quality updates requires a balancing act: Configuring this policy gives you an opportunity to test the latest update on a subset
of PCs in your organization before deploying the update widely; that delay can also put your other machines at risk because they haven't received potentially important security fixes.
- Manage Preview Builds This policy, introduced in Windows 10 version 1709, includes the options to enable or disable preview builds, as you might
expect. A third option, Disable Preview Builds Once Next Release Is Public, prevents preview builds from installing after a preview cycle ends and the corresponding
feature update is released to the public.
- Select The Target Feature Update Version Use this policy to define a specific feature update that you want Windows Update to offer to a device or a group of devices; use the version information as it appears on the Windows 10 Release Information page at https://aka.ms/ReleaseInformationPage. Note that Windows Update will override this policy if the specified version has reached its end-of-service date.
The Windows Update calendar includes more than one Tuesday
Microsoft delivers most scheduled updates on the second Tuesday of each month. Update Tuesday (more commonly known as Patch Tuesday) is the primary day for delivering monthly updates, and it is the only regular release that includes new security fixes.
Additional nonsecurity updates are released on the third and fourth weeks of the month, respectively. (Microsoft refers to these as the "C" and "D" releases, in contrast to the "B" releases on Update Tuesday. Scheduled updates are never released on the first Tuesday of the month, the "A" week.) These are preview releases that are not installed automatically but instead appear under the Optional Updates heading; they are intended to allow administrators to test the nonsecurity fixes that will be shipped as part of the following month's "B" release.
On rare occasions, an out-of-band release appears on Windows Update to fix an urgent security vulnerability (typically one that is being actively exploited) or to resolve a quality issue that has widespread impact. Because out-of-band updates are both urgent and rare, they are issued without respect to the calendar.