Microsoft has recently unveiled a comprehensive guide detailing the intricacies of the Windows servicing model. This guide elucidates the significance of monthly security updates, optional preview releases, hotpatch updates, and the various mechanisms employed to roll out new features throughout the year.
Patch Tuesday updates
Every second Tuesday of the month, known as Patch Tuesday, client and server endpoints operating on supported versions of Windows receive their monthly security updates. These cumulative updates encompass both security and non-security content introduced in the previous month’s updates, thereby streamlining update management and minimizing fragmentation across devices.
For consumers and small businesses, Windows Update autonomously manages these updates. In contrast, enterprise environments have a range of options at their disposal, including Windows Update, Windows Autopatch, Microsoft Intune, Windows Server Update Services (WSUS), Microsoft Configuration Manager, the Microsoft Update Catalog, and various third-party update management tools.
Chris Morrissey, Senior Director of Communications at Microsoft, noted that IT administrators can enroll devices in hotpatch updates, which facilitate quicker compliance. These hotpatch updates focus solely on security fixes and can be installed without necessitating a restart. In contrast, a quarterly baseline update, which is delivered as part of the regular monthly security update, requires a restart and installs all new features and enhancements. Following this, the next two monthly security updates can be applied without a restart.
Testing upcoming fixes
Optional non-security preview updates are typically rolled out during the fourth week of each month. These updates provide IT teams and early adopters with the chance to test and validate forthcoming fixes before they are incorporated into the next monthly security update. Available exclusively for the latest supported versions of Windows, these cumulative updates also grant early access to select new features prior to their wider deployment.
Morrissey highlighted the point-in-time restore feature for Windows 11, a new built-in recovery capability that allows users to revert their devices to a previous state. He also pointed out that certain features may be gradually rolled out, meaning they might not be immediately visible after an update is installed.
For unmanaged devices, optional non-security preview updates can be accessed via Settings > Windows Update > Advanced options > Optional updates. The availability of these updates on IT-managed devices, however, is contingent upon the organization’s update policies.
Out-of-band releases
In addition to the regular monthly updates, Microsoft occasionally issues out-of-band (OOB) updates to address known issues or urgent, high-risk security concerns. These updates can be optional or recommended as security updates, with most being cumulative in nature. Enterprise environments can deploy these OOB updates through Windows Autopatch, the Microsoft Update Catalog, and other enterprise update management tools.
Rolling out new Windows 11 features
Throughout the year, Windows 11 is enriched with new features, enhancements, and fixes via various update channels. Depending on the specific feature and the organization’s update policies, these new capabilities may be delivered through the annual feature update, monthly updates, or Microsoft Store updates.
Microsoft adopts a gradual rollout strategy for certain features, allowing for quality monitoring and compatibility checks before broader availability. The Controlled Feature Rollout (CFR) approach is employed to introduce new capabilities in stages, with features typically disabled by default on managed devices. This strategy enables organizations to determine when these features become accessible through their management controls.
