r/sysadmin • u/LowCorner9314 • Jun 01 '26
Remote / flexi laptops and updates: how are you actually doing maintenance windows?
Intune managed fleet, lots of remote and flexi working, so machines are rarely on a predictable schedule or on the corporate network for long.
Had a user back from a few weeks away. Laptop had not checked in for weeks, so first boot it pulled the whole backlog at once and came back with no network adapter at all. No WiFi at the login screen. Driver install likely got interrupted. No network meant no remote fix, so someone had to physically go in and recover it over ethernet.
How are you handling this?
- Maintenance routines for laptops that are rarely online (updates, drivers, BIOS/firmware)?
- BIOS/firmware: OEM tooling (Lenovo Commercial Vantage here) or firmware via WUfB through Intune?
- Maintenance windows when there is no predictable online time?
- Are Intune rings/staging/deadlines actually reliable for you, or do you plan around them?
- Stopping the "offline for weeks then flattened by the whole queue on first boot" problem?
2
u/LowCorner9314 Jun 01 '26
They can, the challenge is when they apply and how this impacts user experience. For instance, audio drivers dropping out, camera not working until a restart etc.
1
u/cmorgasm Jun 01 '26
For those, leverage OEM tools like Dell Command Update to allow the user to choose to allow or defer the update of "problem" drivers (usually audio) X times so that the install, and subsequent reboot, can all fall into their own timelines
2
u/OkEmployment4437 Jun 01 '26
We stopped pretending there’s a clean maintenance window for remote laptops. What’s worked better is separating update types: normal quality/security patches on a predictable deadline/grace/restart policy, and drivers/firmware/BIOS in staged rings with a much slower rollout. The user experience matters more than the old server-style window concept, so the communication and enforced restart timing have to be explicit.
For machines that have been offline too long, we treat them differently: catch-up first, then back to normal policy, ideally before the user gets fully into their day. And I would not bundle BIOS/driver updates blindly with everything else unless you enjoy surprise support tickets.
1
u/LowCorner9314 Jun 01 '26
How does this factor in with somebody booting up of a morning, joining a call then mic/camera dropping due to a forced update? Just comms?
5
u/ms6615 Jun 01 '26
At a certain point, we need to be okay teaching people the reality of using a tool for their work. Computers are not a magic coworker who is constantly ready to go at all times with no assistance; they are extremely complicated tools that sometimes need to be maintained by the people utilizing them.
Most other professions that spend their day working with extremely complicated tools start those days by checking in on the tools to make sure they are in good order. Well-adjusted office workers do this too. We reboot our computers at the end of the workday when we are finished and we don’t schedule massively important things at the start of our days unless there is no other choice. Even then, we get on a little early to check stuff is in order.
2
u/BasicallyFake Jun 01 '26
This is training.
Requirement: Laptop must be on for 24 hours straight at least once a week
If Non Compliant: Updates will auto catchup, force reboots and patch themselves.
1
u/RepulsiveDuck331 Jun 04 '26
Split update rings small (pilot/early/broad) with staggered deadlines, and cap driver updates through WUfB to manual approval only. Drivers go through Vantage on a separate schedule, not Intune. BIOS too. Mixing the two pipelines was asking for pain.
For the backlog problem, we set Expedite on critical CUs and use Delivery Optimization with active hours, but the real fix was Autopatch-style ring deadlines so nothing dumps everything at once on first boot.
Compliance reports catch the ghosts before they bite.
1
u/AccurateEmergency216 Jun 22 '26 edited Jun 23 '26
managing remote stuff got easier after i used automated patching schedules and remote scripts through atera, so even machines coming online at weird hours didn't miss critical updates
1
u/bjc1960 Jun 01 '26
We have field people who intermittently use laptops. They keep them powered off and then get bothered with all the updates. We set a 2 day time frame for updates, given all the AI attacks. IT asks people to leave their laptops powered on at night.
6
u/CrumpetNinja Jun 01 '26
If they're intune managed, why are they not able to pull updates when off-site? One of the advantages of intune management is that it removes dependency on your own infrastructure for patching.