How to deploy drivers to Windows 10 modern managed devices in a more controlled way with Intune – Mobile-First Cloud-First

maximios October 17, 2021

When we are using modern management on our devices that are running Windows 10 – then we are updating them with WUfB (Windows Update for Business), and that is a good thing, we can manage it so we have control over when a Windows 10 device is getting quality updates and feature update by creating internal update rings.

Feature Updates: previously referred to as upgrades, Feature Updates contain not only security and quality revisions, but also significant feature additions and changes; they are released semi-annually.
Quality Updates: these are traditional operating system updates, typically released the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as those for Microsoft Office or Visual Studio) as Quality Updates. These non-Windows Updates are known as Microsoft Updates and devices can be optionally configured to receive such updates along with their Windows Updates.
Non-deferrable updates: Currently, antimalware and antispyware Definition Updates from Windows Update cannot be deferred.

In some cases we want more control over driver updates when using Windows Update for Business – to do this we need to disable driver update as part of the WUfB.

The real reason I started looking into this was, a customer with a lot of Windows 10 modern devices managed devices and they got a display driver from Windows Update that resulted in BSOD on over 2.000 devices so we needed a solution to be more in control over the driver updates.

First of all we have to have a plan for how to use WUfB and like in any other Enterprise environment we need some kind of control – so I have created a update ring plan.

Here is the big overview on how it can be deployed. I will not into how to do WUfB in this blog post.

So when we have control over the updates in our Enterprise environment we also what some kind of control over the driver updates, and yes we what to update drivers on our devices.

We need 3 simple things to get this working:

Devices that are modern devices managed – create dynamic device groups based on hardware model
Windows Update for Business configured – and disable driver update
Driver packs as MSI files – at this moment it is only Microsoft that is delivering driver packs as MSI (so devices from any other vendors you need to create the MSI with the drivers your self)

Create dynamic device groups

To get total control of what we are doing I create dynamic devices groups with each hardware model.

Here is an example of a dynamic AzureAD device group for SurfaceBook

The dynamic device group can also be created with Powershell

New-AzureADMSGroup -Description “All Microsoft Surface Book” -DisplayName “All Microsoft Surface Book” -MailEnabled $false -SecurityEnabled $true -MailNickname “Win” -GroupTypes “DynamicMembership” -MembershipRule “(device.deviceModel -match “Surface Book”)” -MembershipRuleProcessingState “On”