How are folks handling updates for new PC deployments? At the moment we’re leveraging MDT with a classic gold image and some task sequences. One of these task sequences is to check into WSUS and apply outstanding Microsoft updates. Since the base image isn’t updated frequently we could be catching up on 5-6 months worth of patches during deployment.
With the move the Automox and the eventual hope of dropping WSUS completely we haven’t figured out how to address this piece of the puzzle. If we simple disable the WUA task sequence and deploy the Automox agent the PC would likely be out-of-date until the next Automox update window. Not only does this pose a security risk but that first batch of updates will likely take a while providing a rather poor end-user experience.
We could keep WSUS just for this purpose but that seems like wasted effort. We could update our GPOs to have the PCs reach out directly to MS during the deployment process but we lose control of feature updates as GPO’s can only delay these for 365 days. We also skip the Spring builds and deploy only the Fall builds at this point. which cause issues with that 365 deadline.
Is there a better way to approach this? How are folks dealing with Day 1 updates for newly deployed PCs?