Windows 10 Servicing – A New Way of Updating

Microsoft’s Configuration Manager product is used extensively to deploy and manage computer life cycle for Windows computers. With Windows 10 there are some significant considerations for existing ConfigMgr administrators. With or without Configuration Manager in your organization, you still need to plan for servicing so if you are not aware of these changes, please read on. This is just an overview, there’s a lot of detail I’ve left out in order to try to make this post simple and easy to follow. I’ve included some links at the end of the post to help you out if you need more detail.

Windows 10 Updating Changes

In Windows 10 Microsoft has introduced a new method for updating, upgrading and maintaining the operating system. This new process will be very new and possibly challenging for organizations currently running Windows 7.

Until recently, major feature enhancements to the Windows OS would be released with every new version of Windows, so from Windows 7 to Windows 8 we saw some significant change to the feature set of the operating system. Of course new Windows versions were released about every 3 to 5 years. With Windows 10 release, and moving forward, Microsoft has committed to an entirely different release cycle.

New Terminology

Along with this new servicing model, here are some of the terms we will need to begin to understand (both when speaking about Windows and Configuration Manager);

Term	Description
Upgrade	A new Windows 10 release that contains additional features and capabilities, released two to three times per year. These are often referred to as “feature upgrades”
Update	Security, reliability and other bug fixes that are released periodically, typically once a month on Patch Tuesday. With Windows 10, these are cumulative in nature. These updates are similar to the updates you are familiar with in pre-Windows 10 patching cycles.
Branch	There are four Windows Servicing “Branches” Windows Insider Current Branch (CB) Current Branch for Business (CBB) Long-Term Servicing Branch (LTSB) Your branch determines when you will receive feature updates (upgrade).
Ring	A ring is a grouping of computers that are on the same branch and have the same update settings. Rings can be used internally by organizations to better control the upgrade rollout process.

Several builds of Windows have been released to date. The following table includes the builds up to 1607 Current Branch.

Windows 10 current versions by servicing option

Servicing option	Version	OS build	Availability date
Current Branch (CB)	1507 (RTM)	10240.17071	7/29/2015
Current Branch for Business (CBB)	1507 (RTM)	10240.17071	7/29/2015
Long-Term Servicing Branch (LTSB)	1507 (RTM)	10240.17071	7/29/2015
Current Branch (CB)	1511	10586.545	11/12/2015
Current Branch for Business (CBB)	1511	10586.545	4/8/2016
Current Branch (CB)	1607	14393.82	8/2/2016

Note that the original release of Windows 10 1507, CB and CBB were released simultaneously. Those dates are correct. Moving forward this will not be the case.

Notice the build version numbering. Build 1507 was released in the year 2015, month of July (07). Build 1607 was released in 2016 July (07). 1607 was actually released officially on August 2 but you get the idea. At the time of this writing, the Windows CB installed on systems is 1607 (Windows 10 Anniversary Edition). Version 1511 and 1507, which are the first two builds of Windows 10 are now heading towards end of life.

How a Windows 10 Computer is Configured for a Branch

Windows 10 computers are configured to download updates based on their servicing branch configuration. Four branches – Windows Insider, Current Branch, Current Branch for Business, or Long-Term Servicing Branch – are defined for Windows 10. The two primary branches that corporate administrators will enroll their devices in would be Current Branch and Current Branch for Business. Configuring a computer for CB or CBB is simple – either in client settings, or through GPO settings associated with Windows Update for Business.

Once a computer is configured for a servicing branch, it will install feature updates as they become available for the servicing branch in which the computer is enrolled. Normally Windows 10 Feature Update builds will be downloaded directly from Microsoft’s servers or your corporate Windows Server Update Services (WSUS) server, but for those clients using Configuration Manager, the Feature Update builds will be hosted on your corporate distribution points.

The clock is ticking! How this impacts Configuration Manager environments is that System Center 2012 R2 Configuration Manager with SP1 and System Center 2012 SP2 will allow you to deploy and support ONLY the first two builds of Windows 10. You will be unable to deploy and manage builds post 1511.

If you wish to support Windows 10, ultimately you will need to either upgrade or migrate your System Center 2012 or 2012 R2 Configuration Manager site to the latest version of Configuration Manager, simply referred to as System Center Configuration Manager Current Branch. There have already been 3 builds of Configuration Manager released – 1511, 1602 and 1606. Configuration Manager build upgrades are now far simpler than previous “Upgrade” paths (and Cumulative update paths as well). After installing the base build 1511, future builds are installed as “in console updates” which automatically download and can be installed with little to no additional administrative overhead from within the console itself.

Windows 10 Support Cycle – example

In the following example, lets consider the servicing cycle for Windows 10 to date. This example applies whether or not your organization uses Configuration Manager to deploy updates.

• The original 1507 (RTM) code was released by Microsoft. New system installations receive this build.
  • After the CB 1507 release, a minimum of 4 months pass before Microsoft recompiled the 1507 code, together with all subsequently released security updates, and flagged the code for deployment to systems enrolled for CBB.
  • When Microsoft released the CBB code, installation of 1507 CBB build on systems configured for deferred installation (CBB) begins
• The next big release was the Feature Upgrade build 1511 released to CB.
  • Note that when the 1511 CB (Current Branch) was released, systems configured for Deferred Installation (Current Branch for Business) will continue to use 1507 CBB, and Microsoft will continue to release security updates and fixes for the 1507 release.
  • Users on 1507 CBB will continue to be supported by Microsoft, receiving security updates and fixes until the release of the subsequent CBB 1607 build. So you can postpone feature upgrades – skipping build 1511 entirely is you wish, but once 1607 CBB build is released by Microsoft your 1507 builds will no longer receive security updates and fixes.
• CB 1607 was released in August 2016
  • Likely, the release of 1607 CBB will happen in November/December timeframe of this year, meaning that by this November you must either upgrade all 1507 CBB systems to 1511 CBB or 1607 CBB, or your 1507 systems will be unsupported.

This is where the challenge lies for ConfigMgr administrators. In ConfigMgr we deploy CB and CBB code through ConfigMgr servicing rather than using the Microsoft schedule, and we can build in release delays as required BUT, delaying too long increases the risk that your Windows 10 clients will be unsupported (no new patches and updates) if you delay too long. Since Configuration Manager 2012 and 2012 R2 only support Windows 10 builds 1507 and 1511, anyone not upgrading Configuration before the release of the next CBB build of Windows risks being unable to support your Windows 10 desktops.

LTSB (Long Term Servicing Branch)

The final piece of the puzzle here is the LTSB (Long Term Servicing Branch). This is a feature limited build of Windows 10 that behaves much like Windows 7. Microsoft will continue to release security patches and updates to LTSB for up to 5 years standard and 5 years extended support, which means your LTSB Windows systems will continue to be supported for 10 years. LTSB requires special planning and has some gotchas associated with it that you should consider before jumping onboard but for ATMs, Air Traffic Control systems, plant control systems, which don’t require the full Windows 10 feature set, it can definitely simplify the process. Long Term Servicing Branch (LTSB) is a special build of Windows 10 which must be installed from LTSB media.

Hopefully this helps to remove some of the mystery surrounding Windows 10 servicing. It’s going to be an interesting ride as administrators grapple with how this new model will impact their desktop management processes.

In a Nutshell

• Windows 10 build 1507 CBB is still supported until the release of 1607 CBB – likely this November.
• Windows 10 build 1511 CBB is still supported until the release of the NEXT CBB build of Windows 10 (you should be reasonably safe until middle to late 2017).
• After the next build of Windows 10 is released to CBB, version 1511 will no longer be supported and you will no longer be able to deploy new Windows 10 OS and security patches using Configuration Manager 2012 and 2012 R2.

References

The following pages were referenced when compiling this document.

https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing

https://blogs.technet.microsoft.com/enterprisemobility/2015/10/27/system-center-configuration-manager-support-for-windows-10-and-microsoft-intune/

https://technet.microsoft.com/en-us/windows/release-info.aspx

https://technet.microsoft.com/en-us/itpro/windows/plan/windows-update-for-business