How to manage Windows 11 feature updates with WSUS

Managing Windows feature updates with Windows Server Update Services (WSUS) can simplify the operating system upgrade process. Leveraging groups in WSUS ensures feature updates are distributed to Windows 10 and Windows 11 devices on a schedule that limits user impact, enables testing, and follows established patch management plans.

What are Windows feature updates?

Feature updates are new versions of the Windows operating system. They include new features, security improvements, visual differences, and more. Released annually in the fall, feature updates are Microsoft’s alternative to new OS releases every few years.

As an example, a feature update would take you from Windows 11 version 22H2 to Windows 11 23H3. Terrible version naming aside, feature updates are essentially OS upgrades and are categorized as such in WSUS.

Windows 10 vs. Windows 11 feature updates

When it comes to Windows 10 vs. Windows 11, there are not many differences in the way that feature updates are managed between the two operating systems. However, while Windows 11 continues to receive feature updates, Microsoft has stated that Windows 10 will no longer receive them, officially making Windows 10 22H2 the last version of Windows 10. The most recent version of Windows 11 is 23H2, which was released on October 31, 2023.

While there are many other differences between Windows 10 and Windows 11, not all of them welcome (I’m looking at you, Windows 11 ads), feature updates are essentially managed the same way between both operating systems.

Quality updates vs. feature updates

Quality updates are the standard updates generally released once a month on the second Tuesday of the month, better known as Patch Tuesday. These updates include things such as bug fixes, patches for security vulnerabilities, and system stability improvements. Unlike feature updates, quality updates do not introduce new features or significant changes to the OS.

Because quality updates don’t introduce significant changes to the OS, less testing is required to ensure system compatibility. In comparison, you may want to postpone feature update installations or even skip specific feature updates all together depending on your environment.

Establish a patch management plan

Before we dive into WSUS, I recommend having a patch management plan in place to use as a reference while configuring WSUS. A patch management plan should provide guidance on your patching schedules, testing procedures, user responsibilities, critical systems, rollback processes, and whether feature updates should be postponed or skipped altogether depending on overall system compatibility.

I cannot emphasize this enough: a good patch management plan can save your bacon. Developing one should be a high priority if you don’t already have one in place. (Great, now I can’t stop thinking about bacon.)

How to configure WSUS to manage Windows feature updates

There are several steps we need to go through to ensure WSUS is properly configured to manage feature updates for our Windows 10 and Windows 11 devices. We’ll cover each step to ensure your environment is configured correctly.

Configure groups

With your WSUS console open, the first thing we want to do is create a few groups to help organize our deployments. I like to break up my feature update deployments into three groups — preview, broad, and critical — but you should configure your groups to meet the needs of your IT environment. You may even want to break your groups into Windows 10 and Windows 11 devices.

The preview group is a small set of computers that will be the first to receive feature updates. This group evaluates new feature updates and ensures product compatibility.

The broad group is where the majority of the workstations will reside. This group will receive the feature update once the preview group has thoroughly tested the update.

The critical group is for devices that are vital to maintaining operations. This group will be the last to receive feature updates and may skip specific feature updates altogether to ensure system compatibility.

To create a group, expand Computers, right-click on All Computers, and click Add Computer Group.

Name your group and click Add. Repeat this process for the remaining groups.

Assign computers to groups

Now we need to assign our computers to their appropriate groups. Click on All Computers to view the full list of computers in WSUS. To add a computer to a group, right-click on a device, and select Change Membership. This brings up the list of groups we created. Select the desired group and click OK.

If you have a substantial number of computers in WSUS, there are few things you can do to help this process go more quickly. First, you can highlight multiple computers at once as you normally would with the Shift and Ctrl keys. Another suggestion is to use the Search option located in the Action pane on the right side of the window. Lastly, a Group By option is also found in the Actions pane, which allows you to group your devices by operating system, version, server, make, model, firmware, and mobile operator.

Configure auto approval for the preview group

With our workstations assigned to their appropriate groups, we’re ready to configure the preview group to approve feature updates for installation automatically.

1. Click on the Options menu item in the menu tree.

2. Click Automatic Approvals.

3. Click New Rule in the Automatic Approvals window under the Update Rules tab.

   

4. In the Add Rule window, select When an update is in a specific classification, When an update is in a specific product, and Set a deadline for the approval.

   

5. In the Edit the properties section, click any classification.

6. Unselect all classification types except for Upgrades, then click OK.

   

7. Click any product.

8. Unselect everything except for the versions of Windows you want the upgrades for, then click OK. I’ve selected Windows 10 and Windows 11.

   

9. Click all computers.

10. Select the Preview group and ensure no other groups are selected. Click OK.

    

11. Configure your deadline. I’ve chosen to leave mine at its default setting.

12. Name the rule, then click OK.

    

13. Click OK in the Automatic Approvals window

Feature updates are now automatically approved for installation for the preview group. Since we postpone deploying feature updates for our broad and critical groups, these updates need to be manually approved. Refer back to your patch management policy to determine how long you should postpone an update before deploying it.

How to manually deploy feature updates

Once your preview group finishes testing all the latest OS features and ensuring compatibility, it’s time to roll out the feature update to your broad group. We’ll start by creating a view in WSUS that contains only the updates we want to see.

1. Click Updates in the menu tree in WSUS.

2. Click New Update View in the action pane on the right.

3. Select Updates are in a specific classification and Updates are for a specific product.

   

4. Click any classification, uncheck all options except for Upgrades, and click OK.

5. Click any product, then uncheck all options except for Windows 10 and Windows 11, then click OK.

6. Specify a name for the view, then click OK.

With our new view created, all that’s left to do is deploy the update.

1. Click on the newly created update view in the menu tree.

2. Right-click on the update you want to deploy and click Approve.

3. Click the down arrow next to the Broad group and click Approved for Install.

   

4. Click the drop-down next to Broad once again and select Deadline > One Week.

5. Click OK. The Approval Progress window should appear with the results.

   

6. Click Close.

Deploy feature updates with PDQ

WSUS is generally a good solution for what it does. However, Windows Server Update Services lacks the control and feature set that many sysadmins rely on when deploying packages and updates to their organization. PDQ Deploy & Inventory give you greater control over the entire deployment process. Learn how to manage feature updates with Deploy & Inventory. When you’re ready, download a free trial and discover how to truly take control of your IT assets.