Make Windows Server to be able to check, download, install updates while the server is running.

like Android project Mainline.

so at first there will be 2 OS drives instead of 1, they'll be clones of each other. when an updates pops up, the OS will download and install it on the other drive that is not used to run the OS. the updates can be installed and completely finished on that drive. the next time a system admin restarts the server, OS will boot up from the other updated drive without ANY downtime for installing or finishing updates. once the system boots up, the OS will update the first drive as well to make it ready for the next update cycle and this same procedure can happen again and again.

this greatly reduces server downtimes and will be a great feature to compete against Linux servers.

technically EVERYTHING that can be done in Linux servers CAN be done in Windows Servers too. the only difference is the time it takes to do it.

for example installing a server role on Windows server can take as little as 5 to 10 minutes but on Linux it can take up to 2 hours to get the same result. and it brings No benefits whatsoever.

We have several users under this scenario where they were working in a remote location with no wifi access and they connect through 4G, then a driver download for the Mobile broadband device kicks in and as it normally happens with network related device driver updates, once Windows starts the process of upgrading it, it will briefly disconnect the device, leaving the user with no connectivity.

Currently, we only have an option to allow/block the entire Windows Updates on metered networks from Windows perspective
https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork

It would be great if we can have a granular setting which lets us decide to allow/block Windows driver updates over metered networks.

Hello,

We would like to use LockDown mode on our VPN Always On Device tunnel clients in order to restrict all flows only in the VPN tunnel (not local traffic). Can you tell me if this "Lockdown" feature is supported in a high security context?
Currently, only LockDown mode limits all flows in the VPN tunnel and perfectly meets our needs. In Forcetunnel mode, local traffic is allowed. Of course we don't just want to allow local traffic.
For information, Always On Device tunnel is installed on all of our Windows 10 Enterprise 1909 workstations.
Thank you in advance for your help.
Do you have documentation on setting up LockDown mode?

Thank you.

Cédric

Today's Windows Updates are horrible and very unreliable and Windows Updates are one of the most riskiest operations. Microsoft should take the inspiration from Linux environment as Linux implementation of OS updates is informative, transparent to administrators, it's very nice to work with and administrators have all relevant info in case of any issue or update management. And Linux updates are very reliable.

But in case of Windows Server updates they are a nightmare. Using sconfig provides only very basic information, when updates are downloaded with no information is provided about progress, about downloading process, details about downloaded packages etc. The installation is the same issue - black box hiding all info about the prrocess and it is very hard to work with as nobody knows if the system is stucked or what is happening inside and administrators must just guess what to do. No information is provided by Windows Server and admins can do just wait and pray.

And finally admins must pray if the updates will install correctly and not harming their production OSes as this is happening in Windows world frequently.

Microsoft must put Windows Updates as one of the top priorities as this is crucial functionality for every OS from point view as security, maintenance, reliability etc. Now this is a nightmare and one of the most unreliable services in Windows OS which makes Windows Server very risky environment to work with.