Document Request - MU opt-out changes

[TravisEz13]

Summary of the new document or enhancement

• List of articles that need to be updated:
  Windows install needs to document new wizard page and the USE_MU and ENABLE_MU command line options
• New articles that need to be created:
• Link(s) to related code PR(s) in the PowerShell/PowerShell repo:
  Add mu opt out to MSI install PowerShell/PowerShell#15727
• Link(s) to related issue(s) in the PowerShell/PowerShell repo:

second check box only applies setting, and does not remove settings.

Description of what changed

• Document new windows installer wizard page.
• Document installer command line options
  • USE_MU=1 (default) will opt-in to updating through Microsoft update or WSUS
  • USE_MU=0 will opt-out of updating through Microsoft update or WSUS
  • ENABLE_MU=1 (default) will opt-in to using Microsoft Update the Automatic Updates or Windows Update
  • ENABLE_MU=0 will opt-out of using Microsoft Update the Automatic Updates or Windows Update (meaning we will not change any exist settings)
• Create something for the FAQ page to point to and link to the MU FAQ (if they every give us a page.)

[TravisEz13]

FAQs:

1. elaborate on warning
   • Without Microsoft Update enabled, you will need to use another update solution like WSUS or SCCM in order to receive automatic updates.
   • While the two options on the dialog on independent, in most cases, it doesn't make sense to uncheck the opt-in to Microsoft Update and still check that you want powerShell updates. The only special case for this is if updates are being delivered to windows update through a WSUS server. SCCM is usually this same special case.
2. GP on "Manage when quality updates are received" in Manage updates offered by from Windows Update (See Image 1).
   • This policy will defer updates for a period of time defined by the policy.
     Our updates will almost always be initially released as a quality update even if there is a security issue addressed. Only after there has been some time and the issue has to determined to be serious, would we change an update to be a security update.
3. GP on WSUS
   1. Use GP to make sure user get Updates
      • When deploying updates from WSUS, also deploy a registry value. This will opt the computers into to receiving PowerShell 7 updates.
      • HKLM:\SOFTWARE\Microsoft\PowerShellCore\UseMU as a DWord with the value 1
   2. Not able to use MU
      • Another issue when you have GP enabling WSUS, is there is a possibility that the domain admin may or may not let you use WU or MU.
      • This policy is under Manage updates offered from Windows Server Update Service (see image 3).
      • The policy is called Do not connect to any Windows Update internet locations
4. GP on MU/WU.
   • Group policy can be configured in a way to force you into Microsoft Update or not let you use it.
   • The policy is under Manage End User Experience (see image 2) and the policy is Configure Automatic Updates

Image 1:

Image 2:

Image 3: