Infrastructure — Windows Update

On 24 March 2020, Microsoft stated it would suspend optional non-security C and D week releases for supported Windows versions beginning May 2020 to reduce operational risk during COVID-19 response. Security updates (B releases) would continue.

Why it matters: Patch management schedules and validation pipelines should reflect the pause so teams focus on security fixes and critical quality updates.

• Calendar adjustments: Update maintenance windows to expect only Patch Tuesday security updates; reschedule optional feature validation efforts.
• Configuration management: Ensure WSUS and SCCM configurations do not depend on optional preview rollups for compliance baselines.
• Communication: Notify application owners of reduced change volume and reinforce testing for security updates that continue monthly.
• Monitoring: Track Microsoft release notes for any exceptions or resumption timelines as pandemic conditions evolve.

Architecture considerations

Infrastructure architects and platform teams should evaluate the architectural implications of this development:

• Integration patterns: Assess how this component integrates with existing infrastructure services and data flows. Identify required API changes, protocol updates, or middleware modifications.
• Scalability impact: Evaluate whether this change affects horizontal or vertical scalability characteristics. Plan for capacity adjustments and update auto-scaling policies as needed.
• High availability: Review redundancy and failover configurations to ensure continued resilience. Update health check mechanisms and failover procedures to reflect new deployment characteristics.
• Data persistence: If applicable, assess data migration, backup compatibility, and storage requirements associated with this change. Validate data integrity across upgrade paths.

Document architectural decisions and update reference architectures to guide future deployments and ensure organizational consistency.

Update Cadence Explanation

Microsoft's Windows update release schedule follows a structured monthly pattern. B releases on the second Tuesday (Patch Tuesday) contain security fixes and are mandatory for maintaining protected systems. These releases continue unchanged during the pause.

C releases in the third week and D releases in the fourth week deliver optional quality improvements and feature previews. These releases allow organizations to preview upcoming changes before the next month's mandatory B release. The pause eliminates this preview window.

Understanding this cadence helps IT teams adjust testing strategies. Without preview releases, the first exposure to non-security changes comes in mandatory B releases, reducing validation time before production deployment.

Operational Impact Assessment

Testing workflow changes affect organizations that use C and D releases to validate updates before broad deployment. These organizations must adjust validation processes to focus exclusively on B releases or accept reduced preview time for non-security changes.

Application compatibility concerns may increase without preview releases. Organizations discovering compatibility issues in B releases have less time to address them before the next mandatory update cycle. Plan for increased reactive support during the pause period.

Change management processes should be updated to reflect reduced update volume. Fewer releases mean fewer change windows, which may simplify scheduling but also concentrate effort around remaining Patch Tuesday deployments.

Remote Workforce Considerations

The pause coincided with massive remote workforce expansion. VPN capacity constraints made update distribution challenging for organizations routing all traffic through corporate networks. Fewer updates reduce bandwidth pressure during this transition period.

Endpoint visibility decreases when devices operate primarily outside corporate networks. Ensure update compliance monitoring works for remote devices, and consider cloud-based update distribution to reduce dependency on VPN connectivity.

User disruption from updates becomes more problematic for remote workers without on-site support. The reduced update volume minimizes disruption during a period when IT support capacity is strained.

Resumption Planning

Microsoft committed to communicating resumption timelines as pandemic conditions stabilized. If you are affected, monitor Microsoft announcements and prepare for restored release cadences, which may include accumulated changes from the pause period.

Plan for potential increased change volume when optional releases resume. Changes deferred during the pause may be delivered in subsequent releases, requiring expanded testing capacity and change management bandwidth.

Document lessons learned from operating with reduced update volume. Identify which preview testing activities provided value and which could be permanently eliminated, potentially streamlining post-pandemic update processes.

You may also find useful

Hand-picked articles on adjacent topics.

Infrastructure · Credibility 92/100 · March 19, 2020

CISA Essential Critical Infrastructure Guidance — March 19, 2020

CISA's 19 March 2020 Essential Critical Infrastructure Workforce guidance defined sectors and roles that should continue during COVID-19 restrictions, prompting companies to align continuity plans and worker…

Infrastructure · Credibility 73/100 · March 10, 2020

Microsoft March 2020 Patch Tuesday fixes 115 vulnerabilities

March 2020 Patch Tuesday addressed 115 CVEs across Windows, Office, Edge, and Exchange, including critical remote code execution bugs in font, scripting, and SMB components.

Infrastructure · Credibility 73/100 · April 17, 2020

CISA updates essential critical infrastructure workforce guidance

CISA updated its critical infrastructure guidance for COVID-19, clarifying which workers are 'essential' during lockdowns. If your organization supports critical infrastructure, this guidance helps navigate stay-at-home…

Infrastructure · Credibility 73/100 · February 11, 2020

Adobe February 2020 security updates patch Acrobat, Reader, and Framemaker

Adobe's February 2020 release addressed critical vulnerabilities across Acrobat/Reader, Framemaker, Digital Editions, and Experience Manager with fixes available on Patch Tuesday.

Infrastructure · Credibility 73/100 · February 11, 2020

Microsoft February 2020 Patch Tuesday addresses 99 CVEs

Microsoft's February 2020 Patch Tuesday fixed 99 CVEs—a big month. Critical bugs in IE, Remote Desktop, Exchange, and the Windows kernel. Prioritize and deploy.

Continue in the Infrastructure pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Telecom Modernization Infrastructure Guide

  Modernise telecom infrastructure using 3GPP Release 18 roadmaps, O-RAN Alliance specifications, and ITU broadband benchmarks curated here.

• Infrastructure Resilience Guide

  Coordinate capacity planning, supply chain, and reliability operations using DOE grid programmes, Uptime Institute benchmarks, and NERC reliability mandates covered here.

• Edge Resilience Infrastructure Guide

  Engineer resilient edge estates using ETSI MEC standards, DOE grid assessments, and GSMA availability benchmarks documented here.

Coverage intelligence

Published

March 24, 2020

Coverage pillar

Infrastructure

Source credibility

73/100 — medium confidence

Topics

Windows Update · Patch Tuesday · COVID-19 · Operational Stability · Microsoft Announcement

Sources cited

3 sources (techcommunity.microsoft.com, msrc.microsoft.com, iso.org)

Reading time

5 min

Documentation

1. Timing for upcoming optional Windows releases — Microsoft
2. Microsoft Security Response Center — Microsoft
3. ISO/IEC 27017:2015 — Cloud Service Security Controls — International Organization for Standardization