MDM & GP Tips Blog

Unless you are an SMB, you are probably going to phase in your Windows 11 upgrade over time.  That means that you will have to manage both versions until the upgrade is complete, which might require you to manage their settings or application deployments differently.  If you are using Intune to manage your Windows machines, you can use filtering to reduce the complexity of doing so. 

You can use Intune filters to target configurations, policies, and applications to specific device attributes such as Manufacturer, Model and OS version.  In this case we will create two filters that each target a different OS version.  Using Microsoft Endpoint Manager go to Intune > Tenant administration > Filters and create a new filter and name it as shown below.

Create a rule and select osVersion as the property, StartsWith as the operator and 10.0.2 as the value which I did myself in the screenshot below.  Then finish out the wizard to complete the filter.

Now create a second filter.  There are a couple of options when creating these filters.  You could use the same approach as the previous filter and match it with the Windows 10 value.  In this example, we chose a different approach and instead used the NotEquals operator, typing in 10.0.2 as the value.  This means that any Windows version other than Windows 11 will be included in this filter.

Now that you have the filters created, you can start applying them when needed.  In the example below, I have created a configuration profile that I have assigned to a computer group.  The group is made up of both Windows 10 and Windows 11 machines.  Because I want this profile to only apply to Windows 11 machines, I will click the filter link and choose “include filtered devices in assignment” and select the Windows 11 filter I created earlier.

Finish out the wizard and the configuration profile will now only target Windows 11 devices.  Those familiar with Group Policy will note the similarity to WMI filtering.  Once you upgrade all your Windows 10 devices, simply delete its designated filter.   

Anyone who has been a Windows device admin for a school system that implements a student laptop program is aware of the constant battle to keep students in check when it comes to their devices.  A common ploy by the students is to reset their devices to factory default to bypass enforced security policies.  Even if students can’t get to system settings, they can always hold down the shift key while they use the mouse to select the Restart option from the Windows Start button.  This gets them to the Advanced Startup screen where they can then reset the device.  This of course starts the computer with a clean slate, giving students time to make local accounts on their device.  It also gives them access to the command prompt screen and other things.  For computers that are managed byGroup Policy, students that reset their devices off premise will enjoy a newfound freedom until the computer returns to campus and receives its assigned policies once again.  What’s more, a PC tech may have to manually deploy a package file to install the required applications, consuming precious time from both the student and the technician.  For those computers managed by an MDM provider, policies and applications will be deployed once the computer connects to the Internet, making any acquired freedom brief, but perhaps meaningful enough to be worth the effort to the student.

Even if you don’t work for a school system, you still might want to stop your users from resetting their devices.  Fortunately, there is an easy way to do it using AppLocker to create a policy that can be deployed using Group Policy or your preferred MDM solution that will prevent standard users from implementing a factory reset. 

Create an AppLocker Executable Rule

Using Windows Group Policy Management Editor, create a GPO and go to Computer Configuration > Security Settings > Application Control Policies > AppLocker > Executable Rules.  Right-click and select Create New Rule as shown in the screenshot below.

Using the wizard, choose Deny as the action.  You can target a specific group or just go with the default Everyone group as shown below.

In the next screen choose “Path” as the primary condition.  There are two path executables we need to block.  Each will require their own rule.  For this rule let’s choose:

C:\Windows\system32\systemreset.exe

as shown in the following screenshot.

Continue with the Wizard.  Name the rule and click Create.  Now create another executable rule using the same process.  This time we will use environmental variables for the file path which is %SYSTEM32\ReAgentc.exe.  Now you will have two rules as shown below.

Now assign the GPO to the targeted computers.  But what about Windows 10 devices that are managed by Microsoft Endpoint Manager or similar MDM provider?  In that instance, you can export the AppLocker rules by right-clicking on AppLocker and exporting the policy as shown below.

Name the policy and save it as an XML file.

Now import that XML file into MEM by going to Devices > Configuration profiles > Create policy > Windows 10 and later > Templates and choose Custom and click the Create button.

Now open the saved XML file with a text editor and highlight and copy all the content within the AppLocker tags as shown in the screenshot below.

Using the wizard, name the policy and go to configuration settings.  Here you will need to add the OMA-URI settings.  In the OMA-URI textbox you will input the following path:

/Vendor/MSFT/AppLocker/AppLocker/ApplicationLaunchRestrictions/apps/EXE/Policy

Choose String as the Data type and then paste the XML code you copied into the Value box as shown below.  Then click next until you finish out the wizard and create the policy.

You will then assign the policy to your targeted users.  The next time a student or user attempts a factory reset, they will receive a message informing them that the action is not allowed for their organization. 

Keeping your Windows devices updated is critical today, not only from a security point of view, but a productivity one as Microsoft continues to deliver new features that spawn greater user innovation.  Deploying these updates is only part of the equation when it.  A computer can download a feature update for instance, but unless the computer is rebooted, it won’t be fully installed.  Often, users will delay the rebooting process, thus prolonging the pending start status and preventing it from attaining compliance.  That’s why you must enforce compliance.  Both Group Policy and Microsoft Endpoint Manager (MEM) give admins the ability to create an enforceable compliance window to ensure that Windows update processes are fully completed.

Deadlines and Grace Periods

These compliance policies allow you to configure a deadline that defines the number of days until a device is forced to restart to ensure compliance.  You can also configure an additional grace period to give users a little extra window if needed.  Note that you are restricted to defined ranges when assigning these time windows.  For Group Policy the ranges are as follows:

• For quality updates the deadline can be between 0 and 7 days.
• For feature updates the deadline can be between 0 and 14 days
• Grace periods are limited to 0 to 3 days regardless of the type of update

MEM provides longer durations to accommodate mobile devices.

• For quality updates the deadline can be between 2 and 30 days.
• For feature updates the deadline can be between 2 and 30 days
• Grace periods are limited to 0 to 7 days regardless of the type of update

For quality updates, the deadline and grace period start once the update is offered to the computer.  In the case of feature updates, both start once the update has been installed and the computer reaches a pending restart state.

Configuring Compliance Policies

To enforce a compliance policy using the Group Policy Administrative Console, go to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience and choose “Specify deadlines for automatic updates and restarts.”  You can then configure the deadline and grace periods for both quality and feature updates as shown below.

Note that you have other settings available concerning the restarting process that you can assign as well.

To configure deadline and grace period durations using the Microsoft Endpoint Manager admin center and go to Devices > Create Update ring for Windows 10 and later.  Turn on the Allow button to enable deadlines and then assign the deadline and grace period for each update category.    Note that the deadlines and grace periods are appended to any configured deferral period.  The process is shown in the screenshot below.

By enforcing update compliance for your Windows machines through GP or MDM, you can ensure that required update processes are completed, keeping your computers secure and maximizing user productivity. 

Many organizations are choosing to use some type of MDM provider to manage their mobile devices.  Some organizations are even turning to MDM for all of their client devices.  If you have been relying on Group Policy to deliver configuration and security settings to these your Windows devices, you should know that there is still a disparity gap between between Group Policy and an MDM such as Microsoft Endpiont Manager (MEM) when it comes to setting coverage.  While Microsoft has closed this gap considerably over the past couple of years, there are still a number of Group Policy settings that MEM and other MDM solutions don’t accommodate.   Obviously, you need to know what settings can’t be replicated when considering a move to MDM.

MEM now provides an easy to use tool called Group Policy Analytics (Preview) that will analyze your on-premise GPOs and determine how they will translate into the cloud.  It will analyze a specific GPO and identify which settings are supported in the MDM, which ones have been deprecated and which ones are simply not available.  The first step is to select the GPO you want to test out in the Group Policy Management Console.  As shown in the screenshot below, simply right click on your selected GPO and choose “Save Report.”  Save it as an XML file.

The next step is to import the XML file into MEM.  Using the MEM admin center, go to Devices > Group Policy analytics (preview).  Select Import and point to the saved XML file as shown in the screenshot below.  Note that the saved XML cannot be larger than 4 MB. 

Click the X in the upper righthand corner and wait for the analyzation process to complete.  You will then see the percentage of settings are supported by the MDM.

Now click on the stated percentage and review the status of all your settings.  The supported settings will list the corresponding CSP mapping in the righthand column as shown below.

Group Policy analytics is a great tool to determine the MDM setting coverage of your GPOs.  If any of the non-supported settings are critical to your management or security policies, you may want to continue using Group Policy for a while longer or utilize a third-party settings management solution.

In our final segment of this series, we are going to wrap up our discussion concerning Windows update management.  So now that you’ve configured your update rings and settings, you can create a compliance policy to reinforce them using Microsoft Endpoint Manager and going to the
“Devices |Overview” section and selecting Compliance policies near the bottom of the menu as shown below.  Here you can also click on Compliance status and view the compliance status of your enterprise fleet

Create a new policy and choose Windows 10 and later as the platform.  Name your policy and then go to Compliance settings > Device Properties.  Here you can set the minimum OS version to be compliant.  You can also set a maximum if desired.  In the example below I have assigned 21H1 as the minimum OS version with 21H2 as the max. 

You can then determine what your action will be for non-compliant status.  You can choose to either send an email to the user of the device or choose the hard-core action of retiring the device for noncompliance as shown in the screenshot below.  A grace period of 3 days has also been configured.

The final step is to assign the compliancy policy to your designated group(s). 

Managing Updates in a Co-managed Environment

Those enterprises that use Microsoft Endpoint Manager Configuration Manager can utilize either WSUS or Windows Update as their update source.  Here’s a good example of the flexibility this offers.  Let’s create a GPO and go to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Server Update Service.   Here you would configure settings to specify the IP address of the WSUS server.  The settings we want to focus on is “Specify source service for specific classes of Windows Updates” as is shown in the screenshot below.

Enable the policy and then choose the source service for each update class.  In the example below I am assigning the WSUS server as the feature update source and Windows Update for quality updates.

While we are in Group Policy, let’s look at some other useful settings.  If you are fully managing the update environment for your end user devices, there is no need to perpetually send Windows update notifications to users.  In the screenshot below I enabled the Display options for update notifications.  Note that I have also enabled “Speficy deadlines to use Windows Updates and restarts” where just as I demonstrated in MEM earlier, you can assign a deferral period and grace period for Quality updates and Feature updates.  I also chose to remove access to all Windows update features for good measure by enabling that policy.

Here I chose to disable all update notifications other than restart warnings in order to give them a heads up about pending restarts.

Conclusion

Ensuring that all your Windows machines receive the latest quality updates is one of the most important steps you can do to secure your devices.  Quality updates fix bugs and improve the reliability of your machines so that they run optimally for users.  While feature updates are not as imperative, they cannot be ignored either as you need to make sure that users have access to new features that can help stimulate innovation and improve productivity.  It’s a big job, but Microsoft provides the management tools to ensure that your machines remain update accordingly. 

There are times when we all wish we had the ability to turn back time to undo a mistake.  This is certainly the case for Windows support teams that have had to deal with a sudden surge of help desk calls due to the havoc created by a recent non-security bug fix in a recent Windows update.  The traditional way to remediate such an issue has been to uninstall the update, a time-consuming process that overstretched IT personnel don’t have time for.  How great it would be if there were a way to simply roll back to the prior state up the update by implementing a single policy.

Known Issue Rollback (KIR)

Microsoft released Known Issue Rollback (KIR) beginning with Windows 10, version 2004.  Its purpose is to improve support for non-security bug fixes and make life a little easier for internal IT by rolling back the undesired changes of an update.  KIR starts at the code level as every non-security bug fix retains the old code while adding the fix on top of that.  Fixes are enabled by default, thus disabling the old code.  A KIR policy, however, can disable the fix however and revert the OS back to the old code-path, problem averted.

Now, when Microsoft determines that a non-security update has an issue, it generates a KIR to roll it back.  Microsoft’s goal is to deploy a KIR within 24 hours of identifying the root cause of a reported problem so that most users are never exposed to the bug.  For non-enterprise users, the process is completely automated, requiring them to do nothing.  In many cases the KIR will be implemented prior to the download being installed.  End users that have installed the update will be prompted to reboot their machines.

KIR and the Enterprise

The process is a little more involved for enterprise customers.  In this case, Microsoft releases a policy definition MSI file that admin teams can deploy using Group Policy (an Intune solution reportedly on its way).  These KIR policy definitions have a limited lifespan of only a few months as the aim for Microsoft is to quickly address the issue through a new update.  KIRs are announced by Microsoft through Windows Update KB articles and listed on the Known Issues list located on the Windows Health Release Dashboard where you can find a link to download the MSI.

Creating a KIR Group Policy

Once downloaded, simply run the MSI which will install the ADMX/ADM template files into the local store at C:\Windows\PolicyDefinitions as is shown in the screenshot below:

You can use the Local Group Policy editor to create a KIR policy for the local machine.  To deploy the policy to multiple machines across your domain, you will need to copy the files to your central store located in your SYSVOL folder.  Be sure to include the ADML template file located in the EN-US folder.

In this example I am using a KIR that was released last year for Windows 10 version 2004.  I first made a GPO using the Group Policy Management Console and named it KIR Issue 001.  Then go to Computer Configuration > Administrative Templates > and select the KB rollback issue listed as shown below.

Then open the policy setting and choose Disabled.

You can create a WMI filter to specifically target machines running the designated Windows version. This is done in the Group Policy Management Console by right-clicking WMI Filters and selecting New.  Name the filter something like “Apply to all Windows 10, version 2004 devices.”   Then insert the following string:

SELECT version, producttype from Win32_OperatingSystem WHERE Version = "10.0.19041"

The screenshot below shows the newly created WMI.  You can find out the build number of your Windows version here

Now go back and highlight the GPO you just created and look for the WMI Filtering section at the bottom where you will select the appropriate filter.  You can also use a third-party solution such as PolicyPak to for granular filtering as well.

Conclusion

KIR is a recent Windows servicing technology that can help you escape from the nightmare of a Windows update bug-fix gone bad.  This is also a good example of why you should manage your Windows updates using Windows Update for Business that gives you greater management control over when and how updates are implemented throughout your enterprise. 

In my last blog segment, I used MEM to configure some policies related to Windows updates.  Let’s now see what happens behind the scenes because there is an awful lot that goes on each time a policy assigned device goes seeking updates.

In this instance, I have a policy Feature Update Deployment policy assigned to a desktop PC that currently hosts Windows 10 21H1.  Since 21H1 was released back in April of 2021, it obviously needs updating.  Let’s say I have been working remotely from home for a using my laptop and haven’t been to the office in months.   In the feature update policy, I created I chose to deploy Windows 11.  I also chose a specific time frame that it would be made available as I want to give our IT team additional time to test for Windows 11 compatibility issues concerning our application portfolio.  In this case I chose February 21, 2022, as the earliest available date.  The PC is also assigned to a business update ring that has a quality update deferral period of 7 days.

On February 11, I return to the office for a department meeting and power up the desktop.  MEM has already contacted Windows Update and provided the PCs ID and the targeted feature update to be deployed.  MEM also will deliver any new policies that have been assigned to the PC since the last time it was online.  In this case it includes the Business Update for Ring policy settings.  Next the PC will contact the cloud to seek possible updates.  In doing so, the PC informs Windows Update of any assigned deferral periods, its current OS version, and its revision status.  This entire process is outlined in the diagram below.

Let’s see what happens first regarding feature updates.  There are two feature updates available on February 11 for the PC - Windows 10 21H2 and Windows 11.  Because the targeted feature update policy dictates Windows 11, 21H2 is out of the picture.  Windows 11 would be made available if it wasn’t for the deployment period I specified which starts on February 21.  That means no feature updates for our desktop PC today.

Now let’s look at Quality updates.  Since my computer hasn’t been powered up in quite a while, its missing a lot of quality updates so it’s revision status is quite outdated.  Fortunately, quality updates are cumulative, so I don’t have to download the updates released every single month since it was last powered on.  Quality updates are released on the 2^nd Tuesday of each month.  This means the most recent release date was February 8.  Because I have a deferral period of 7 days, February updates will have to wait a few more days before they are made available.  As a result, the January Quality updates will be applied to my desktop. 

I then spend the next few days using my laptop at home and return to the office on February 16.  Once again, my desktop PC checks in for Windows updates and because the deferral period is now over, February quality updates are now downloaded and installed.  Windows 11, however, will remain elusive until the 21^st.  On February 23^rd, I return to the office and Windows 11 is now available.  For the update to be issued, Windows Update must first determine if it is compatible or not.  This is performed automatically using Windows Update for Business.  If you have Update Compliance configured in Azure along with a Log Analytics Workspace, you can verify the compliance status of any listed device.  While the PC itself may exceed the compliancy requirements of Windows 11, the update can still be deferred due to a safeguard hold assigned by Microsoft.  Safeguard holds prevent devices with a known compatibility issue from receiving a new feature update.  For instance, an installed application on the device may have compatibility issues with Windows 11.  You can read more about safeguards here in one of my other blogs.  In this instance, there is a safeguard hold assigned to my desktop so until a fix is released for that issue it will have to wait on Windows 11 for a while.

More to it than Meets the Eye

As you can see, there are a lot of moving parts when it comes to Windows Updates for Business.  In our remaining segment, we will wrap up our discussion by looking talking about compliance deadlines, automatic restarts, and touch on Group Policy one last time. 

Think of WSUS as version 1.0 for managing Windows updates.  Windows Update for Business can be considered version 2.0 as it is the next evolutionary step for managing updates for Windows 10 and Windows 11.  Unlike WSUS, clients connect directly with Microsoft Endpoint so there is no intermediary server involved.  All you need is a management tool such as Group Policy Management Console, an MDM tool such as Microsoft Endpoint Manager or a third-party management tool.  The management tool is where you create the update policies and assign them to designated device groups.  Once the clients receive the policy, they contact Microsoft endpoint which sends them one or more updates depending on the client’s provided inputs.  If you have the Windows Update for Business Deployment service installed, the manager can talk directly with Microsoft Endpoint as well.

Deferring and Pausing Updates

One of the enhanced features that Windows Update for Business provides is the ability to defer the installation of both feature and quality updates for a specified number of days.  The deferment period depends on the type of update as shown below.

Update Category                             Maximum deferral period

Feature updates                                             365 days

Quality updates                                                30 days

Non-deferrable                                                   0 days

You can also choose to pause quality or feature updates all together.  This is similar to deferring an update except you specify an exact date.   Beginning on that date, updates are paused for 35 days.  This is useful if you discover that one of the recent updates is causing problems and you want to buy some time to conduct further testing.   You can configure the required settings to defer or pause an update using Group Policy.  Create a GPO and go to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business where you will see several policy options.  In the screenshot below, we have configured a deferment period of 15 days as well as a specific date to start pausing Quality updates.

Windows Update Rings

Windows Update for Business also gives you the ability to create update rings to fine tune the deployment of quality and feature updates.  Rings specify how and when quality and Windows 10 and Windows 11 feature updates are applied.  For instance, let’s say you want to deploy the Windows 11 feature update.  For a large corporation you certainly wouldn’t want to install it on everyone’s computer at once right out of the gate.  You would probably want your IT personnel group to receive the update first to allow them to test it out first.  That would mean creating a fast update ring and assigning it to them.  You would next want to update devices for power users such as software developers, graphical artists, etc.  You would create a slower ring and, and so on.  Below is an example of a 3-ring architecture.

You can create these rings using the Group Policy Management Console.  Create a GPO and go to Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select “When Preview Builds and feature updates are Received.”  Enable the policy and select the ring of your choice as is shown in the screenshot below.  Then assign a deferral period for that ring.  In the example below we have chosen a 2-day deferral period for the Fast Ring.  We would then choose a longer period of perhaps 45-days for the slow ring.

To create rings for Quality Updates you would create a policy and go to Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are Received. 

Using MEM to Manage Windows Updates for Business

You can also use Microsoft Endpoint Manager to manage Windows Updates for Business.  If you open  MEM and go to Devices you will see 3 options.

A small enterprise may not feel the need to utilize multiple update rings.  If you want to simply deploy Windows 11 at large, click “Feature updates for Windows 10 and later” and select Windows 11 as the feature update.  You can then choose between pushing the update as soon as possible, making it available on a specific date or gradually dispersing the update across your enterprise.  In the example below I chose the third option and set a start and finish time for the deployment.

If you want to use update rings, the process is similar.  Create a ring with your desired settings and assign it to a designated group.  Note below the addition of an uninstall period that you can assign. 

You can also configure User Experience settings for each ring.  User experience settings give your users the ability to defer updates on their own when necessary.  This would be important for a sales executive that is attending a sales conference for instance and needs the full use of their computer for an extended time.  For instance, you can configure a grace period that specifies the number of days until a device is forced to restart.  This would be useful for users returning to the office from extended leave or a long holiday period.  You should first configure the active hours so that update-initiated reboots do not occur during this critical time window.  You can then configure deadlines.  In the screenshot below, users could defer feature updates on their own for 7 days, at which point the update would forcibly install.

Service Channels

Finally, there is something called Service Channels.  Service channels define when features updates will be available.  For instance, someone that is a member of the Windows Insider Program probably wants to receive feature updates in advance to preview them.  Internal IT needs access to new feature updates ASAP to validate them for their desktop environments.  These four channels are as follows:

• General Availability Channel – This is the default channel
• Windows Insider Dev
• Windows Insider Beta
• Windows Insider Release Preview

You can create policies using Group Policy or MDM to create policies that assign these channels.

Putting it all Together

Windows Update for Business obviously has a lot more moving parts than the media or WSUS methods.  Things can get complex quickly.  In part 3 of our ongoing series, we will look at an environment involving multiple Windows feature versions and deferral settings to see how the underlying processes occur to ensure that each device receives the updates it needs. 

Managing Windows updates is one of the most important functions for Windows admins today.  The methodologies available to manage and deliver updates to Windows servers, desktops and laptops has changed a lot over the years.  In this 4-part series, we will outline the different management options that are available today and break down how Windows Update Manager works and why it should be the preferred management alternative for today’s enterprises.  Before we get started, define what we mean by Windows updates.

Types of Windows Updates

There are two broad categories of Windows updates.  The first is quality updates.  These are the updates that are mostly released on what we have come to traditionally know as ‘Patch Tuesday.’  Quality updates are referred to cumulative updates or maintenance updates.  Most quality updates are released to either address a security issue or fix a problem to improve the reliability and security of Windows.  These are known as mandatory updates.  Other quality updates may provide some preview enhancements of existing features.  A reboot may be required once all the newly downloaded quality updates are installed. 

Then there are feature updates.  Feature updates are made available twice a year and are known as semi-annual releases.  You can think of a feature update as a new version of Windows.  Feature updates can be deferred for up to 365 days although each new version is only supported by Microsoft for a period of 18 months which is another benefit of updating.  Feature updates can introduce new features as well as visual changes to the operating systems.  The objective here is to constantly improve the Windows operating system.  A feature update may require a series of reboots to complete the update process.   

Now let’s look at the three primary ways of managing Windows updates.

Media

This is the most basic way of all to manage Windows updates.  Here the computer contacts Microsoft Endpoint directly to learn of any available updates.  The local admin of the computer can then choose to either download and install those updates at a designated time or defer them to the automated process.  This one-to-one relationship is shown below.

Obviously, this method is not suitable for enterprise environments as there is no way to centrally manage the updates of multiple machines.  It is designed for personal users or very small SOHO environments. 
 

Windows Server Update Services

Windows Server Update Services (WSUS) has been around for a long time and used to be the primary way that admins managed Windows updates for enterprise environments.  WSUS was designed back in the days of a totally on-prem world.  Think of the WSUS server as a repository for Windows updates.  Rather than each Windows machine directly contacting Microsoft for updates and using a lot of precious bandwidth in the process, the WSUS server downloads all updates and retains them on local storage.  Besides the WSUS server itself, WSUS also requires a manager which can be one of the following:

• The WSUS Stand-alone console
• Group Policy
• MEM CONFIG Manager
• A third-party management tool

Regardless of which management tool you choose, you must create policies to govern the Windows update process.  The policy must identify the WSUS server and outline when updates will occur.  These policies can be assigned to either device groups or the devices themselves.  The admin then approves which updates they want to distribute.  The manager then then informs the WSUS server of the newly approved list.  When prompted by their assigned policies, Windows devices then scan their updates against the WSUS server itself.  The WSUS server then offers each device any approved updates that it is missing.  This process is outlined below.

WSUS was an ideal solution for managing Windows updates for enterprise environments at one time.  There are two primary limitations of WSUS currently.  The first is the fact that Microsoft has not provided any enhancements to WSUS in years, and it will eventually be deprecated.  The bigger factor however is that the world has changed in recent years.  WSUS cannot adequately service hybrid work models and remote work strategies as all Windows desktops must be connected in some way to the local network.  For this and other reasons, Windows Update for Business is a better choice in many cases.  In our next blog segment, we will look at the architecture of Windows Update for Business and how to implement it.

Microsoft recently released the Chromium-based Microsoft Edge 95 version to Stable channel for Windows and Mac, which coincides with a new security baseline for it as well.  Some of the new features of the new Edge version include the following:

• A new efficiency mode that becomes active when a laptop enters battery saver mode so that the two work in tandem to extend the battery life of the machine.
• The ability to pick up where you left off on PDF documents and resume your review of the documents.
• The ability to update your passwords with fewer clicks as the browser will navigate a user to the Change Password page for a given website assuming that the website supports that feature.  The browser will also suggest a strong, unique new password. 
• Supports free form text boxes within PDF documents that allows users to use them to fill out a form. 

Because the browser today is the most frequently used application, it is critically important to keep your security baselines up to date to ensure you are running best practice.  MDM administrators that utilize Microsoft Endpoint Management (Intune) are familiar with the concept of Security Baselines.  A security baseline is a collection of Microsoft recommended configuration settings that help secure and protect enterprise users and devices.  Security baselines are an easy and effective way for admins to ensure that they are consistently enforcing a minimum-security level that will address fundamental security and compliance issues.  The Security Baselines for Group Policy are designed around the same principle as the MEM Security Baselines.  You can download the new security baseline package here by selecting the Microsoft Edge v95 Security Baseline.zip file. 

The Benefits of Using Security Baselines

While it is perfectly ok to configure your own MDM profile or GPO to select and configure available settings, baselines are a quick and easy way to enforce a default baseline that prevents users from making changes that will result in an insecure state.  There are several benefits of using security baselines offered by Microsoft.

• They are already configured by Microsoft security experts
• They enforce settings that mitigates contemporary security threats.
• Baseline settings have been pretested to ensure that they do not cause operational issues that are worse than the risks they mitigate
• They ensure that users and device configuration settings are compliant with the baseline

Installing the Microsoft Edge v93 Security Baseline

Once downloaded, you will see that the package contains multiple folder directories as is shown below.  Note that unlike other packages, this one doesn’t include a Template folder as this package does not include the ADMX/ADM template files.  You can download the template files directly from the Microsoft website for any of the current Edge versions.  You must have the required template files in your central store for the package to work.

The next step is to import the new security baselines.  You can import these policies either locally or into AD using the enclosed scripts.  I am choosing to import them into my AD environment using the appropriate scripts as shown below.

Then choose the location where you want to link the new policy and browse for the new MSFT Edge 95 – Computer.

In my case, I chose the East Sales OU to link it.  Note that this is a computer side GPO, so it needs to be linked to an OU that contains computer objects.  The screenshot shows the enclosed settings below.

There are two new security baseline settings.  The first is “Enable browser legacy extension point blocking” which blocks code injection from third party applications on the new Edge browser.  The setting is enabled by default as is shown below.

The other new enforced setting is “Specifies whether the display-capture permissions-policy is checked or skipped.  It allows web applications using the getDisplayMedia() API to bypass a permission policy check required by the API specification This setting is only temporary and will be deprecated after Microsoft Edge 100.  It is intended to block Enterprise users whose application is non-spec compliant.  The setting is enabled by default as is shown below.

All in all there were 1 new computer settings and 1 new user settings for Microsoft Edge version 95 with 3 settings being removed.  You can learn more about these settings here.