Windows 10: Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft

GHacks · Aug 6, 2022

We all know that Windows Updates may lead to issues on target devices during installation or afterwards. Updates in the past have caused all kinds of issues, from boot issues over lost data to broken functionality.

image credit: Microsoft

When Microsoft releases new feature updates for Windows, it is using Machine Learning and a feature called Safeguard holds to reduce the likelihood of disaster.

Feature updates are distributed in waves via Windows Updates, but these waves are not just randomly selected. The first wave hits devices that are considered to be least likely affected by updating issues. Microsoft uses Machine Learning to pick these devices.

All Windows machines benefit from Safeguard holds. These block updates on machines with known issues. Known issues are confirmed by Microsoft engineers. Devices that are matched to issues are blocked from receiving the updates; this is one of the reasons why updates are offered to some devices and not to others.

Likely issues are different in several aspects. Microsoft describes a likely issue as unconfirmed issues that its machine learning service identified across millions of unmanaged home and business devices that it scans dialy.

These indicators of issues can be rollbacks during updates, a malfunctioning app or driver, graphics, audio or connectivity issues, or other kinds of issues that appeared in sizeable numbers after the installation of an update.

Unlike known issues, which result in the blocking of updates on all unmanaged Windows devices, likely issues are only blocked for business customers. Specifically, the feature is only available to "organizations with Windows 10/11 Enterprise E3 or greater, including Education variants" according to Microsoft.

Machine learning puts devices that would be affected by likely issues on hold to avoid that the issue is experienced on these devices. Likely issue safeguard holds vary in time according to Microsoft; they give administrators time to "make an informed decision on how to proceed with the update".

Likely issues that are confirmed become known issues. Safeguard holds affecting known issues impact all Windows devices that are unmanaged, which means that home users benefit from them as well. Likely issues may also be deemed false positives or more scoped in nature. Safeguard holds are then removed for devices that are not affected by the issue.

Read more on SafeGuard Holds on Microsoft's Tech Community website.

Closing Words

Microsoft does not reveal why it limits likely issue Safeguard holds to business customers. Home users would benefit from the blocking of updates as well if their devices are identified as having likely issues. In fact, one could argue that Microsoft is putting these devices at risk by now blocking the updates.

Now You: should Microsoft block likely update issues on home devices? (via Deskmodder)

Thank you for being a Ghacks reader. The post Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft appeared first on gHacks Technology News.

read more...

Brink · Aug 6, 2022

Safeguard holds with Windows Update for Business deployment service

Safeguard holds are one of several previously announced protection features of the Windows Update for Business deployment service. In this article, we explore how you benefit from safeguards to protect devices under your management during deployments. Specifically, we'll review:

Safeguard holds for known and likely issues

What safeguard holds look like behind the scenes

How to make the most of safeguard holds

Earlier this year, we started a new blog series exploring these features, which are designed to work together to help you have a smoother experience when updating and upgrading your organization's devices. These features are available to organizations with Windows 10/11 Enterprise E3 or greater, including Education variants. The first such feature we explored was Gradual rollouts with the Windows Update for Business deployment service. Gradually rolling out the update to intelligently ordered waves of devices reduces risk and gives IT pros more confidence in deployment success. If you haven't read this article, I recommend you check it out! Millions of devices managed by IT have been upgraded to the latest Windows using gradual rollouts to simplify the process and reduce deployment risks.

Safeguard holds for known and likely issues

If you have been using the Windows Update service to deploy a new version of Windows to your devices, you have already benefited from safeguard holds for known issues. This includes all Windows Update for Business users. When you go beyond traditional client policies and enroll in the Windows Update for Business deployment service, this protection is expanded to safeguard holds for likely issues as well. Let's define these types of issues and see how they work.

What's a known issue?

A known issue is a problem that may occur after an upgrade that was discovered by Microsoft or reported by a customer or partner. This issue has been evaluated and confirmed for a specific set of devices.

What's a likely issue?

When some devices face complications after an upgrade to Windows 11, protecting customers' devices quickly is a priority. In addition to safeguard holds for known issues, the deployment service utilizes machine learning (ML) performed across millions of unmanaged, daily consumer and commercial PCs installing the upgrade. It looks for any evidence of rollback during setup, an app or driver malfunction, graphics, audio or connectivity issue, etc. When upgrade problems like these surface, this ML spots correlations among device hardware and software characteristics to identify a larger set of devices that have not yet started the upgrade and automatically safeguards them. While this early correlation is not yet a confirmed (known) issue, it is a likely issue. Essentially, where there is smoke, there is often fire, and safeguarding likely issues offers a quicker and higher protection level for such devices.

What safeguard holds do to protect your devices

If Microsoft finds a potential quality or compatibility issue, the safeguard hold feature automatically pauses updates to just those devices that are identified as exposed or at a high risk of exposure. Figure 1 illustrates how an update is paused before the deployment service offers it to devices under your management.

Safeguard holds in action: Diagnostic data from device upgrades not managed by IT informs the deployment service to pause an update deployment to devices under your management.

What safeguard holds look like behind the scenes

That's all great, but how does it really work? Let's look closer at how issues are identified and the process of safeguarding your devices, including the lifespan of these protective measures.

Identifying known issues

We receive feedback from many different channels that tell us about known issues with a Windows update. Feedback comes from partners, customers, Windows Insiders, and our own internal testing process. Once we identify issues that may impact devices after upgrade, we build device-specific criteria that are delivered to impacted devices as a safeguard hold. Safeguarded devices are then paused from updates until the issue has been mitigated.
Identifying likely issues

To make safeguarding likely issues possible, pattern mining is used across millions of daily devices installing the upgrade from Windows Update that are not managed by IT. Specifically, machine learning is applied to the diagnostic data from our broad device ecosystem to automatically identify patterns correlated with update-related disruptions. Data from customer devices using Windows Update for Business is always used in accordance with the Microsoft privacy policy. Figure 2 shows an abnormal failure pattern peaking at 82% against a baseline rate of about 3%.

Abnormal update failure pattern across time (adapted from: Using machine learning to improve the Windows 10 update experience)

A pattern refers to a specific combination of attributes. These include hardware characteristics, drivers, and applications – the same attributes that determine device assignment to waves in gradual rollouts. For example, a pattern may reveal an incompatibility between driver X and a third-party app Y on the same device.

The process of safeguarding your devices

Once the machine learning algorithm finds this pattern, it triggers a temporary safeguard hold for a likely issue. Its lifespan varies in duration and prioritizes safety over progress to preserve end user experience and IT peace of mind. The delay allows you a few weeks to make an informed decision on how to proceed with the update to keep your device population protected and productive. We aim to address the temporary hold for a likely issue in four to six weeks by either:

Confirming and transitioning the likely issue to a known issue with safeguard hold maintained.

Identifying a false positive and automatically removing the hold so devices begin updating.

If Microsoft verifies the issue and confirms that the device is indeed not ready to update (scenario a), the safeguard hold transitions to a known issue and continues to delay the device's upgrade until a mitigation is applied. If Microsoft verification deems the likely issue to be a false positive or more scoped in nature (scenario b), the temporary safeguard hold is removed for unaffected devices so the upgrade may proceed, if approved by IT.

Microsoft uses two guiding reasons for issuing an automatic safeguard hold for likely issues:

We have also paused deployment to consumer devices likely exposed to the issue.

The issue is under active investigation by Microsoft engineers.

Windows Update maintains a safeguard hold until Microsoft investigates, develops, and validates a fix before offering it to affected devices and restoring the update deployment. Once a fix or mitigation is delivered via Windows Update or a third party, the safeguard hold is lifted, and the device can be offered an update. This ensures a seamless protection experience for end users and IT.

How to make the most of safeguard holds

Enable safeguard hold protections to maximize your update deployment experience today! These capabilities are available to you through the Microsoft Graph, PowerShell SDK, Intune, and Update Compliance. Deployment scheduling controls are always available. However, to take advantage of the unique deployment protections tailored to devices under your management, configure devices to share diagnostic data with Microsoft and leverage available reporting tools.

Ensure device prerequisites are met

Diagnostic data must be set to Required or Optional.

The AllowWUfBCloudProcessing policy must be set to 8 (see how to do so in Microsoft Endpoint Manager, using Group Policy, or mobile device management).

Safeguard holds apply to Windows Update for Business deployments by default. We do not recommend opt-outs or manual updates, except for strict IT environments and for validation purposes only.

Monitor safeguard holds reporting

If you are affected by a safeguard hold, you will get additional insight into the issue through the M365 Admin Center or the Known Issues sections of the Windows release health dashboard online. You can also monitor your device population with up-to-date reporting.

If you use Update Compliance, you can check your safeguard hold report to see which devices under your management are affected by which safeguard holds. The same information is presented in two different views: the total safeguard hold view (see Figure 3) and device view, which you can sort device by device. While all safeguard holds are marked with an 8-digit identifier, the safeguard hold ID value for all likely issues is 00000001.

The Update Compliance total safeguard holds view.

(Source: Update Compliance - Safeguard Holds report)

If you use Intune, safeguard holds are now visible in the Feature Update Failures Report. For additional ways to monitor and report on safeguard holds, refer to the documentation of your management solution, such as Am I affected by a safeguard hold?

Stay in the know!

Safeguard holds offer tailored solutions to your environment. This feature is informed by partners, customers, and the latest Microsoft machine learning efforts around known and likely issues that emerge while we are updating the broad ecosystem of devices. That said, we would love for you to join one of our early validation programs to discover any potential issues even before your organization-wide deployment:

Security Update Validation Program (SUVP)

Windows Insider Program for Business

This information on the workings of safeguard holds for known and likely issues is meant to prepare you to optimize your update deployment experience. Together with the gradual rollouts feature of Windows Update for Business deployment service, safeguard holds serve to give you additional peace of mind and keep your organization even more protected and productive.

There is more to explore, and our next blog in the series will continue this topic by focusing on automated rollback monitoring. Enjoy the new features available to you through the deployment service and let us know what you think in the comments below or on the Windows Tech Community!

For additional context, visit our existing publications:

Windows Update for Business deployment service (Docs)

Access safeguard hold details with Update Compliance (Windows IT Pro Blog)

Safeguard holds (Docs)

Click to expand...

Source: https://techcommunity.microsoft.com/...t/ba-p/3590463

Brink · Aug 6, 2022

Microsoft explains safeguard holds for Windows 10 Feature Updates

Safeguard holds

Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.

Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10.

The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices.

Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments.

Am I affected by a safeguard hold?

IT admins can use Update Compliance to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version.

Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the Windows release health dashboard, where you can easily find information related to publicly available safeguards.

On devices that use Windows Update (but not Windows Update for Business), the Windows Update page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message:

If you see this message, it means one or more holds affect your device. When the issue is fixed and the update is safe to install, we’ll release the hold and the update can resume safely.

What can I do?

We recommend that you do not attempt to manually update until issues have been resolved and holds released.

Caution
Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out.

With that in mind, IT admins who stay informed with Update Compliance and the Windows release health dashboard can choose to temporarily opt-out of the protection of all safeguard holds and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically.
Click to expand...

Source: https://docs.microsoft.com/en-us/win...afeguard-holds

How to Disable Safeguard Holds for Feature Updates on Windows 10

Brink · Aug 6, 2022

Safeguard holds with Windows Update for Business deployment service

Enable or Disable Safeguard Holds for Feature Updates in Windows 11 Tutorial | Windows 11 Forum

Windows 10: Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft

Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft

Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft

Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft

Windows Update: Safeguard Holds for likely issues are only for businesses, says Microsoft - Similar Threads - Update Safeguard Holds

Rechecking Safeguard Holds for Windows Update

Rechecking Safeguard Holds for Windows Update

Rechecking Safeguard Holds for Windows Update

Windows Update safeguard holds on W10 Home

Safeguards holds

Microsoft explains safeguard holds for Windows 10 Feature Updates

How to disable Safeguard Hold for Feature Updates on Windows 10

Windows update won't update, there is a safeguard hold??????

Windows 10 Update - Safeguard Hold