Moving Windows Update Workload from SCCM to Intune and Cleanup GPO Registry Keys for Smooth Intune Update Deployment
As organizations
increasingly adopt Intune for modern device management, it becomes necessary to
transition certain workloads, such as Windows Update management, from SCCM
(System Center Configuration Manager) to Intune. This shift enables you to
leverage cloud-based management, offering benefits like simplified
administration and greater flexibility.
In this blog post,
we'll explore how to move the Windows Update workload from SCCM to Intune and
use PowerShell scripts to clean up old Group Policy Objects (GPO) registry keys
that may interfere with Intune-based update management. Additionally, we will
discuss how to use detection and remediation scripts to ensure the devices are
ready for Intune update deployment.
Steps to Move
Windows Update Workload from SCCM to Intune
Before you can
move your Windows Update management from SCCM to Intune, you need to follow a
few steps to properly set up your environment for Intune-based Windows Update
management:
1. Disable SCCM
Software Update Point (SUP)
The Software
Update Point (SUP) role in SCCM manages Windows updates. To transition this
responsibility to Intune, the first step is to disable the update management in
SCCM.
In SCCM, go to
Administration > Site Configuration > Sites.
Right-click on the
site where the SUP role is installed, and select Remove Roles.
Uncheck the
Software Update Point and confirm the removal.
2. Enable
Windows Update for Business (WUfB) in Intune
Next, configure
Windows Update for Business (WUfB) policies in Intune to manage updates:
In the Microsoft
Endpoint Manager Admin Center, navigate to Devices > Windows > Update
Rings for Windows 10 and later.
Create a new
update ring that defines when and how updates are deployed to your devices.
Configure update
settings like deferral periods, active hours, and automatic update behavior.
3. Assign Update
Rings to Devices
Once the update
rings are configured, assign them to relevant groups or devices in your
environment. This ensures that Intune will control how and when updates are
deployed to these devices.
Using PowerShell
Scripts for GPO Registry Cleanup
When transitioning
to Intune-managed updates, you may need to clean up old Group Policy registry
keys set by SCCM, WSUS, or previous GPO configurations. These old registry
settings can interfere with Intune’s update management.
We will use a
PowerShell script for detection and remediation of Windows Update-related
registry keys.
Detection
Script: Check for Existing GPO Registry Settings
This script checks
if any Windows Update-related registry keys are still present, indicating that
Windows Update is being managed by an old GPO. If found, it will return a
non-compliant status.
# WU Registry Key
Detection Script
$regPath =
"HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate"
$keys =
Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
if ($keys) {
Write-Output "Windows Update GPO
settings found"
exit 1
# Non-compliant status
} else {
Write-Output "No Windows Update GPO
settings found"
exit 0
# Compliant status
}
Remediation
Script: Clean Up Registry Keys
If the detection
script finds Windows Update GPO settings, the remediation script will delete
the associated registry keys, ensuring that Intune can take over Windows Update
management.
# Remediation
Script to clean up GPO registry keys for Intune update deployment
# Define the
registry paths to be deleted
$registryPaths =
@(
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate",
"HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
)
# Function to
delete registry keys
function
Remove-RegistryKey {
param (
[string]$path
)
if (Test-Path $path) {
Remove-Item -Path $path -Recurse -Force
Write-Host "Deleted registry key:
$path"
} else {
Write-Host "Registry key not
found: $path"
}
}
# Delete the
registry keys
foreach ($path in
$registryPaths) {
Remove-RegistryKey -path $path
}
# Restart Windows
Update service to apply changes
Restart-Service
-Name wuauserv
Write-Host
"Registry cleanup complete. The device is now ready for Intune update
deployment."
Additional
Detection Script: Verify Windows Update Service (WUfB)
This script checks
whether the Windows Update service is being managed by Intune (via Windows
Update for Business). If it is, the device is ready for Intune updates.
# Detection Script
to verify if Windows Update is managed by Intune (WUfB)
$WUServiceManager
= New-Object -ComObject "Microsoft.Update.ServiceManager"
$WUService =
$WUServiceManager.Services | Where-Object { $_.IsDefaultAUService -eq $true }
$WUServiceNameDetails
= $WUService.Name
if
($WUService.Name -eq "Microsoft Update") {
Write-Output "Intune (WUfB) -
$WUServiceNameDetails."
Exit 0
# Compliant
} else {
Write-Output "Not Intune (WUfB) -
$WUServiceNameDetails."
Exit 1
# Non-compliant
}
This detection
script will help confirm that the Microsoft Update service is controlled by
Intune’s Windows Update for Business (WUfB) settings.
Conclusion
Transitioning the
Windows Update workload from SCCM to Intune allows for a modern, cloud-based
approach to update management. By cleaning up old GPO registry keys and
verifying that devices are configured for Intune-managed updates, you ensure a
smooth and seamless update process for your organization's devices.
By using
PowerShell scripts for detection and remediation, you automate the process of
preparing devices for Windows Update for Business (WUfB) in Intune, making the
transition efficient and secure.
