Had a customer ask if the documentation "could be clearer in regards to continue on failure and fail if requirements aren't met".
[18 December 2020: This article has been updated to reflect changes in the way Microsoft offers Windows 10 Feature Updates and the way that ZENworks supports the updates.]
In a previous article I explained that the ZENworks Patch Management content feed includes Windows 10 Quality Updates (security and reliability patches) but not Windows 10 Feature Updates (version updates). This is primarily due to the larger file size and installation mechanism for Feature Updates.
Even though the content feed does not include Feature Updates, you can still use ZENworks Patch Management to deploy Windows 10 Feature Updates. There are a couple of methods--enablement packages and custom patches--you can utilize depending on the currently installed Windows 10 version and the target update version.
Starting in 2019, Microsoft began ensuring that both versions (H1 and H2) released in the same year share a common core operating system with an identical set of system files. The new features for the H2 version are delivered starting in the last H1 monthly Quality Update prior to the H2 release. The H2 features remain dormant until they are turned on by applying the enablement package. Microsoft published an article explaining the details and benefits of this method that I'll let you review rather than rehashing here.
The ZENworks Patch Management content feed contains the enablement package for both Windows 10 1909 and Windows 10 20H2. The following applies to the enablement package:
In ZENworks Patch Management, the enablement package works the same as other patches. Follow the steps below to use the package:
The second update method is to manually download the Feature Update and distribute it as a custom patch in ZENworks. This works for updating from any version to another version (provided Microsoft supports the update path).
The process includes a few additional steps on your part but allows you to automate the deployment of the Feature Update while using the Patched status to track which devices are updated and which ones still need to be updated. The basic process is this:
The remainder of this article shows how to use this process to update devices from Windows 10 Enterprise version 1909 to version 2004.
You need to download the Windows 10 ISO from a source such as the Volume Licensing Service Center, the MSDN Portal, or the Academic Products page. For example, I get my Windows 10 ISOs from my MSDN account.
For this article, I will update a device running Windows 10 Enterprise version 1909 to version 2004 using the Windows 10 (business editions), version 2004 (Updated Oct 2020) (x64) - DVD (English) ISO with the following filename:
Your Windows 10 devices need to run the update executable from somewhere on your network. In my lab environment, I chose to copy the contents of the ISO to a Win10bus_2004update_x64 folder on my ZENworks Server and then share the folder (read access) with a local server account called WindowsUpdateAdmin.
I also defined the WindowsUpdateAdmin account credentials in the ZENworks Control Center Credentials Vault to make the credentials available when installing the Feature Update.
My configuration worked for my lab environment. Obviously, you’ll need to find the appropriate access solution for your lab and production environments.
In ZENworks Control Center, create a Windows bundle that launches the Feature Update executable from your network location.
At this point, you could simply assign the bundle to the Windows 10 devices you want to update. After refreshing and getting the bundle assignment, the devices (on which the bundle is effective) would launch the setup program and install the Feature Update (unless the device is already version 2004).
However, if you include the bundle in a patch (as explained in the next sections), you can use Patch Management to see which Windows 10 devices have been updated (Patched) and which Windows 10 devices still need the update (Not Patched).
Alternate Method: Local Installation
Installing the Feature Update from a network location is the preferred method, but it is also possible to create a bundle that copies the Feature Update to the device and runs the update from the local drive. Because most Feature Updates are quite large (around 5 GB), copying the update to all devices could impact your network. Before using this method widely, we strongly recommend that you evaluate the impact by targeting a smaller set of devices. Once you know the impact, you can perform a controlled update by targeting the appropriate number of devices at different times.
NOTE: In the Comments section following this article, Craig Wilson of our Support team mentions a ZENworks Agent issue that caused the Feature Update to fail when run via the Dynamic Administrator user. As he notes, the issue was fixed in ZENworks 2017 Update 4. We strongly recommend updating the ZENworks Agent on your devices to ZENworks 2017 Update 4 or newer. Otherwise, you will need to use the local installation method for the Feature Update.
If you choose to do the local installation method, modify the Windows 10 Feature Update bundle as follows:
You can now create a custom patch that includes the Feature Update bundle. Using a patch to distribute the Feature Update bundle allows you to easily track which devices have the patch applied and which ones do not.
We enhanced the Custom Patch wizard in ZENworks 2020 Update 1 to provide additional methods of detecting the Patched status of devices. Therefore, I have provided instructions below for creating a custom patch in ZENworks 2020 Update 1 or in ZENworks 2020 or older versions.
After you have created the custom patch and run the subscription to include it in the Windows 10 DAU file, you need to run a patch scan on your Windows devices. At that point, the devices will report their Patched status for the custom patch and you can view the status in ZENworks Control Center.
You can wait for the scheduled patch scan to run or you can use a Quick Task to initiate a patch scan on devices. The Quick Task is available from the Devices list.
Once you have the Patched status for devices, you are ready to deploy the Feature Update custom patch to the unpatched devices.
You can deploy the patch via a manual remediation or a Patch policy.