Windows Update for Business - Gone?

Posted by Fallingdamage@reddit | sysadmin | View on Reddit | 11 comments

Last year, after confirming that the new Windows 11 group policy templates work with Windows 10 and Server OS's, I updated my policy templates on our domain. Today, I discovered that 'Windows Components' > 'Windows Update' > 'Windows Update for Business' was missing... so many of my update policies have not been applying. At first I thought i was going crazy but I pulled a fresh Windows 11 Pro machine that is not domain joined and checked its PolicyDefinitions and sure enough, Windows Update for Business is gone. This is normal right? It looks like MS broke up the Windows Update policy items into individual categories now. I dont always bother to read and crosscheck every policy item of the tens of thousands of items that may or may not change every time there is a policy update. Time to refresh/update my policies.

Reply to Post

11 Comments

[-]

SonOfDadOfSam@reddit

You don't need the new templates on the local machine unless you're configuring settings on the local machine. It should still apply any group policies you have regardless of what templates are on the client. At least as far as I can remember. We've been on Azure for a few years now so I don't really deal with GPOs anymore, but I was always able to update the templates on the machine I created the GPOs on. It could be that some of the Windows 11 policies only apply to Windows 11, and that Windows 10 only uses the older ones. You may need to create separate policies and filter them by OS.

[-]

Fallingdamage@reddit (OP)

> You may need to create separate policies and filter them by OS. Oh I do. I have a Windows Update GPO/Link that applies only to Workstation OS's. Odd - When I run gpresult /h in Win10 I do not see any of the modern policies listed as being applied, however, when I run rsop I do see them.

[-]

SonOfDadOfSam@reddit

You should also be able to make a filter that applies one set of policies to win10 devices and a separate set for win11. Also, gpresult shows whether the gpo has been applied. Rsop will tell you which settings have been applied. Maybe gpresult needs to have the new templates to show what's applied. I didn't think it did, but I could be wrong. It could be a special case where the two gpos are mutually exclusive.

[-]

Fallingdamage@reddit (OP)

Upon further investigation (and calming of nerves) I discovered that I wont need to create separate policies for W10 and W11. My original windows update policies 'Windows Update' and 'Windows Update for Business' never left but MS creatively *moved* them without configuration loss. In the newer ADMX files, Windows Update has been broke out into *Legacy Policies* *Manage end user experience* *Manager Updates offered from Windows Server Update Service* *Manage updated offered from Windows update* Within those subcategories, my original policies still exist AND are still set and applying. I did not have to reconfigure them. As I mentioned above, oddly gpresult doesn't show any of the policies when I export an html report but if instead I run rsop and expand the policy tree, I do indeed see the W11 policies applying to windows 10 machines.

[-]

EdAtWorkish@reddit

they just have totally failed to update their documentation - as below - and only seem to refer to the Windows 10 ADMX locations for these settings.... which is nice https://preview.redd.it/4fvrmmed9mfd1.png?width=669&format=png&auto=webp&s=79ac53e1c40818ce1996d33e0ae84571cbbdd1bd

[-]

ITGuyfromIA@reddit

Idk about the WUfB being removed from the admx templates, but I do know that policies applying does not require the template to be present or functional. We use the templates to navigate the gui and set values. We also use the template when displaying results. Your policies are likely applying as you set them Also, this is the first I’ve heard that windows 10 and 11 admx templates are cross/backwards compatible. Maybe I missed that update, but last I knew they were not.

[-]

St0nywall@reddit

Windows 11 ADMX are now backwards compatible with Windows 10 starting from July 2023. The latest Windows 11 ADMX templates work very well for multiple OS's now. [https://www.microsoft.com/en-us/download/details.aspx?id=105667](https://www.microsoft.com/en-us/download/details.aspx?id=105667)

[-]

segagamer@reddit

>Also, this is the first I’ve heard that windows 10 and 11 admx templates are cross/backwards compatible. Maybe I missed that update, but last I knew they were not. Wait really? So replacing the ADMX files is generally a bad idea while we have Windows 10 machines around? How do you handle this then?

[-]

mapbits@reddit

Thankfully, they resolved backwards compatibility last summer; see note in blue box here: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-or-windows-11-gpo-admx-which-one-to-use-for-your/bc-p/3880918

[-]

Fallingdamage@reddit (OP)

Well, though I see that Windows 10 and Windows 11 policies look different when I view them via gpedit.msc, When im managing domain policies they (now) appear the same as when I view the W11 policies. If I click on a policy, It tells me that it applies to "At least Server 2016 or Windows 10" so im probably good, but they've moved a lot of stuff around and moved some of the most important policies to 'legacy policies'. Things like *no auto-restart with logged on users* is considered legacy now. There is no equivalent in the modern policies.

[-]

frac6969@reddit

Some of the policies got moved from Windows Update for Business into Legacy Policies. They may or may not work. [Why you shouldn’t set these 25 Windows policies - Windows IT Pro Blog (microsoft.com)](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/why-you-shouldn-t-set-these-25-windows-policies/ba-p/3066178)