Pushing Updates by group at different dates.

Question

Hey all,
Hopefully this is a simple question, but the disclaimer here is that I am fairly new to InTune. In short, we already have a policy set up so that critical updates are auto approved and pushed to workstations.
For security updates/rollups I would like to do this:
Approve xx number of updates and push them to a test group in InTune
Wait one week to test for any issues caused by the above bullet
If no problems, take these EXACT updates previously approved for the test group, but apply them to our local office
Wait one week to verify no issues
If no problems, take these EXACT updates previously approved for test group and local office and apply them to our various remote offices.
My problem is that I am not exactly sure how I can find the EXACT updates that I previously approved the week prior when deploying them to my test group. This is our patching policy for the company so I cannot adjust the above steps. Can anyone advise on
how to simply accomplish the above? The break down is that this was previously managed by a person no longer with the company and there are random declines/approvals for updates all over so it's really tough for me to (right now) keep track ... hopefully the
above is clear. If you have any questions, please feel free to ask otherwise thanks for the help!
-Ryan

Answer 1

Ryan,
Here is the problem with Exact -- lets say update KB1111111 was released on Jan 1, 2014 at version 1.0
You test deploy that update to TestComputerGroup by approving and setting a deadline of Jan 5 2014.
You run a update report on TestComputerGroup on Jan 7th and see all computers in the group successful.
Now you wait until Jan 14th and having heard no problems schedule the update for ProductionGroup2 with a deadline of Jan 20th.
There are is a few areas areas of concern for EXACT, but it really boils down to this:
You need to remember that you don't have a local "cache" of updates that you manage, the updates are pulled down by the client directly from windows update (with the possibility of some internal corporate caching system like BranchCache)
What are the rules for if an update is revised that would or would not require an explicit approved by the intune admin
Can you get a report that shows update status WITH update revision data
If you are international, you might also have regional windows update repository issues. If for example a client located in china pulls from a different windows update set than a if the same computer was in USA.
I am not 100% sure on what the rules are for #1, and I have not seen a report on #2.
As far as management of updates to different groups at different times, that is there as I described. But it depends on what you mean by EXACT.
-Neil
neilgo