Windows Patch Management: Rings & Deadlines
Windows patch management rings and deadlines are scheduling tools that control when updates install and force them by a set date. Rings group devices into deployment waves, and deadlines set a hard cutoff for installation, giving you staged rollouts with enforced compliance.
What Are Update Rings and Deadlines?
Update rings are a Windows deployment concept (used in Windows Update for Business and Intune) that let you divide devices into groups, each with its own update policy. A typical setup uses three rings: Ring 1 (a small pilot group of IT or test machines), Ring 2 (a broader set of early adopters), and Ring 3 (the rest of the organization). Each ring can have different deferral periods, maintenance windows, and deadlines.
Deadlines are the key enforcement mechanism. You set a deadline date (and optionally a time) by which the update must be installed. Once the deadline passes, Windows forces the installation, often with a countdown and automatic restart if needed. Deadlines work alongside grace periods, which give users extra time before a forced restart.
How Rings and Deadlines Work Together
Rings and deadlines complement each other: rings control the order of deployment, while deadlines control the pace within each ring.
- Deferral: Each ring can delay updates by a set number of days (e.g., 7 days for Ring 2, 14 days for Ring 3). This gives you time to monitor for issues in earlier rings.
- Deadline: Within a ring, you set a deadline (e.g., 14 days after the update is offered). After that, the device installs the update automatically, even if the user hasn’t clicked “Install.�
- Grace period: You can add a grace period (e.g., 2 days) after the deadline before a restart is forced, giving users time to save work.
Example: You release a Windows 11 feature update. Ring 1 gets it immediately (deferral 0). Ring 2 gets it after 7 days. Ring 3 after 14 days. You set a deadline of 14 days for Ring 2, so those devices must install it by day 21. This staggered approach limits the blast radius of a bad update.
Why Deadlines Matter for Security
Deadlines are critical for security because they close the window of vulnerability. Without a deadline, users can postpone updates indefinitely, leaving known exploits unpatched. Microsoft’s own guidance emphasizes that deadlines are the primary way to ensure compliance with security updates. For example, a critical zero-day patch should have a short deadline (e.g., 2 days) so all devices are patched quickly, while a feature update might have a longer deadline (e.g., 30 days) to allow for testing.
However, deadlines alone don’t guarantee safety. You still need to monitor for issues in early rings before pushing to the rest. The common misconception is that deadlines are just about forcing restarts—they are actually about enforcing a security baseline.
How to Configure Rings and Deadlines
You can configure rings and deadlines through Windows Update for Business (WUfB) in Intune or Group Policy. Here’s a step-by-step approach using Intune:
- In the Microsoft Intune admin center, go to Devices > Windows > Update rings.
- Create a new ring (e.g., “Ring 1 – Pilot�). Set the Microsoft product updates and Windows drivers as needed.
- Under Quality update deferral period, set the number of days to delay (0 for pilot).
- Under Quality update deadline, set the number of days after which the update must be installed (e.g., 2 for critical patches).
- Repeat for other rings with increasing deferrals and deadlines.
- Assign the ring to a device group (e.g., “IT Department� for Ring 1).
For Group Policy, use Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business. Set “Specify deadlines for automatic updates and restarts� to enable deadlines.
Common Mistakes and Pitfalls
Even with rings and deadlines, things can go wrong. Here are frequent errors:
- Setting deadlines too short: A 1-day deadline for a feature update can cause user disruption and failed installs. Always match the deadline to the update type.
- Ignoring maintenance windows: Deadlines can force restarts during business hours if you don’t set active hours or maintenance windows. Configure those to avoid interruptions.
- Not using grace periods: Without a grace period, users get a sudden restart. Add a 2-3 day grace period to let them save work.
- Forgetting to pause updates: If a bad update is discovered, you can pause the ring, but that only works if you’re monitoring. Set up alerts for update failures.
Another misconception: deadlines are only for feature updates. Quality (security) updates also need deadlines—often shorter ones.
Costs and Licensing Considerations
Using rings and deadlines via Windows Update for Business is included with most Windows 10/11 Pro and Enterprise licenses—no extra cost. However, if you use Intune to manage rings, you need a Microsoft Intune license (often bundled with Microsoft 365 E3 or standalone). There’s also an operational cost: time spent planning ring groups, monitoring rollouts, and troubleshooting issues. For small businesses, the built-in Windows Update settings (without Intune) allow basic deferral and deadline settings via Group Policy, but without the centralized reporting that Intune provides.
Alternatives and Comparisons
Rings and deadlines are not the only way to manage Windows updates. Alternatives include:
- WSUS (Windows Server Update Services): On-premises, gives you full control over which updates to approve, but requires more manual effort and doesn’t have built-in ring scheduling.
- Configuration Manager (SCCM): Offers deployment rings via collections and maintenance windows, but is heavier to set up.
- Third-party patch management tools: Often provide cross-platform support and more granular reporting, but at an extra cost.
Compared to WSUS, rings and deadlines in WUfB are simpler and cloud-based, but they rely on Microsoft’s update service, so you have less control over exactly which updates are offered (though you can pause or approve via Intune).
Best Practices for Safe Rollouts
To get the most out of rings and deadlines while keeping your environment safe:
- Start with a small pilot ring (5-10% of devices) and wait at least a week before expanding.
- Use deadlines that are long enough for testing but short enough to close security gaps—typically 7-14 days for quality updates, 30 days for feature updates.
- Always set active hours (e.g., 8 AM to 6 PM) to prevent restarts during work.
- Monitor update compliance and failure rates in each ring before moving to the next.
- Have a rollback plan: if an update breaks, pause the ring and use “Uninstall update� or a restore point.
Remember, rings and deadlines are not a substitute for testing. They are a way to manage risk, not eliminate it.
Frequently Asked Questions
What’s the difference between a deadline and a grace period?
A deadline is the date by which the update must be installed. The grace period is extra time after that deadline before a forced restart occurs. For example, a deadline of 10 days with a 2-day grace period means the update installs by day 10, but the restart can happen as late as day 12.
Can I set different deadlines for different types of updates?
Yes. In Intune, you can set separate deadlines for quality updates (security) and feature updates (major versions). Typically, you’d set a shorter deadline for quality updates to patch vulnerabilities quickly.
What happens if a device misses the deadline?
Once the deadline passes, Windows will automatically install the update and schedule a restart (respecting active hours). If the device is offline, it will install the update as soon as it comes online and then restart, possibly without a grace period if one wasn’t set.
Do deadlines work for devices that are rarely online?
Deadlines only apply when the device is online and can reach Windows Update. If a device is offline for weeks, the deadline will be enforced when it next connects, but the update may install immediately without user warning. For such devices, consider using a longer grace period.
Can I use rings and deadlines without Intune?
Yes, you can configure them via Group Policy in Windows 10/11 Pro/Enterprise. However, you won’t get the centralized reporting and management that Intune provides. For small environments, Group Policy is a viable free option.
Should I set a deadline for driver updates?
Driver updates are often riskier because they can cause hardware issues. It’s safer to set a longer deadline (or no deadline) for driver updates, and test them thoroughly in a pilot ring before broad deployment.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.