Event banner
Event details
Where can I find information on the future of WSUS for environments that are only on-prem with no internet connectivity for the clients?
- Jason_Sandys
Microsoft
Other than the blog post at Windows Server Update Services (WSUS) deprecation - Windows IT Pro Blog, there's no additional information to share. Keep in mind that this post is meant to indicate our future intention and not to cause immediate action for customers as actual retirement is still ~10 years away. We fully appreciate that folks will want to begin planning because of this, but for now, we have nothing additional to share for air-gapped scenarios although this is top of mind for us, and we will share information as we are ready to share it.
- EricMoe
WSUS is included in Windows Server 2025, which has a product lifecycle documented at Windows Server 2025 - Microsoft Lifecycle | Microsoft Learn.
Thanks. I was told that WSUS would be phased-out and wanted to confirm when that would occur.
Will Autopatch be fully available for A3 and A5 licensed users? As of now it seems like it's only partially available.
- EricMoe
Not all Autopatch features are fully available for A3/A5, each page on aka.ms/autopatchdocs should call out which features are and are not available for A3/A5 licenses. At this time, we have nothing to announce concerning any additional changes.
I am moving from Trellix Disk Encryption to Bitlocker. I decrypted the machine from Trellix and then encrypted with Bitlocker. The Drive gets encrypted, however after a restart the machine is always asked for the Bitlocker key. I did notice in the System Information with Secure Boot enabled, PCR7 binding is not possible and PCR7 is not supported. I updated, TPM version, BIOS version and all drivers. Also ensured Modern Standby is enabled and secureboot too. Any ideas on how to resolve this issue? I see this on all machine in the environment.
- Jason_Sandys
The best resource to start with is Windows Server shows PCR7 configuration as "Binding not possible" - Windows Server | Microsoft Learn. If this does not help, I suggest opening a support case.
Thank you. One more question. For Bitlocker is SecureBoot a requirement?
- Heather_Poulsen
Community Manager
Welcome to Windows Office Hours! IT pros - we're here to answer your questions for the next hour so please post them here in the Comments. Experts from Windows, Intune, and customer experience teams are here to help. :)
- Dylan_Snodgrass
Exciting!
Hey Heather :)
Is there a possibility of the Intune Remote Help program having the ability to allow unattended remote control like Remote Control in SCCM?
- Jason_Sandys
This is an item in our backlog that we've received a lot of feedback on. It is ultimately something that we want to add but we have nothing to share at this time regarding timeline for delivery.
Hi, is there a way to set Windows Services as Automatic via Intune (config profiles and other means?)
thks- Jason_Sandys
There's nothing to natively do this today, however, using a PowerShell script called using a Remediation can easily accomplish this. We do fully appreciate that this isn't as elegant as having a native switch, knob, or control for this and do receive feedback from time to time on this and are always happy to receive more to help us prioritize requests and engineering work.
Hi,
is there a way to use the autopatch reports without having to put devices into rings.
We only use WUFB, but we would like to use the Autopatch reports since they seem to be better in some aeras.
Thks- EricMoe
Autopatch reports requires that you go through Autopatch feature activation - Windows quality and feature update reports overview | Microsoft Learn. If you are using WUfB today, we make it really easy to import your existing WUfB ring configurations into Autopatch using Manage Update rings | Microsoft Learn. WUfB relies on update rings, so you should already have some sort of ring-based configuration set up. Definitely explore the power of what you can do with Autopatch groups, because you can get some very easy ring definitions (dynamically assign across rings by percentage for instance) without a lot of overhead.
Hello Microsoft Team,
In my company we have already a ring based system, where we manage our devices automatically and split them between different on-prem AD security groups.
We have enrolled our tenant with Windows Autopatch and created different Autopatch groups.
For each Autopatch group we have assigned our own custom ring based AD security groups, and within Autopatch settings we are only using the deployment test ring (which is empty) and the deployment last ring (assigned with our own custom group).Autopatch Group | Deployment Ring | Assigned AD Security group
Autopatch RING.0 | Autopatch RING.0 - Last | RING.0 - Test ServiceDesk Users
Autopatch RING.1 | Autopatch RING.1 - Last | RING.1 - Test IT Global
Autopatch RING.2 | Autopatch RING.2 - Last | RING.2 - Test Pilot Users
Autopatch RING.3 | Autopatch RING.3 - Last | RING.3 - All Production UsersFrom time to time we have the need to move some of the devices between different security ad groups (rings).
Is there a way (remediation script or another method) for Autopatch to check if the devices have been moved from the original autopatch group and if so, to un-register them and re-register the devices again in the current and correct new autopatch group?- EricMoe
Hi Pedro, with some of the latest updates we have applied to Autopatch, you can simply move devices from one group to another and Autopatch should take care of the rest. If you remove a device entirely from your Autopatch assigned groups, the device should get deregistered from Autopatch. Remember to ensure your AD groups do not have overlapping memberships, as that will create conflicts.
Is Microsoft Update Health Tools supposed to be installed on Windows 11 24H2? I noticed my Intune remediation script (which runs if the "Microsoft Update Health Service" service does not exist) has recently run on every machine that has upgraded. That tells me that it was removed as part of the upgrade, which makes me wonder whether it is meant to be installed on this Feature Update.
(If you're not aware, the Microsoft Update Health Tools update is required for expediting security updates through Intune, as documented here).
Hello Microsoft team,
What is the best recommended path for the upgrade on the following Windows Client OS:
Windows 10:
1. Windows 10 22H2 PC to Windows 11 22H2
2. Windows 10 22H2 PC to Windows 11 23H2
3. Windows 10 22H2 PC to Windows 11 24H2
Windows 11:
1. Windows 11 22H2 PC to Windows 11 23H2
2. Windows 11 22H2 PC to Windows 11 24H2
I have Windows 10 22H2, Windows 11 22H2, Windows 11 23H2. I am trying to find the best recommended path to get them upgraded to the latest Windows 11 24H2. Please provide some clarity (if possible, can you guys come up with an article for upgrade strategy).
Thank you in advance.
We're currently upgrading everything straight to W11 23H2 but will switch straight to 24H2 once we have finished testing it :)
- ThomasTrombley
Hi!
Our team is presently putting the finishing touches on a complete revamp of learning modules below. They will include specific objectives, tactics, and deliverables that should help you move forward. I believe we'll have it completed by the end of November, but will follow up with my team:
- Plan to deploy updates for Windows 10 and Microsoft 365 Apps: Here you'll learn to use the Windows servicing process to help your organization implement a plan to stay current with the latest Windows 10 feature and quality updates.
- Prepare to deploy updates for Windows 10 and Microsoft 365 Apps: In this module, we share more on validating critical apps, implementing changes to reduce time and effort around feature updates, updating supporting infrastructure, selecting devices for pilot deployment, and more.
- Deploy updates for Windows 10 and Microsoft 365 Apps: In this module, we share more about implementing pilot and broad deployments, accelerating velocity, and improving the overall process.
I know this may look like a marketing approach, but we sit in engineering, and have been working with SMEs (some here in Office Hours today!) to overhaul. Feel free to ping me directly and I can share more on the overhaul in progress.
I'm also looking at moving to WIN 11, but I think it'll be 23H2. I'm still hearing issues with 24H2.
