What's different about them? Are they related to each other? How do deadlines factor in?

Maintenance Windows (MW) and Business Hours are targeted to two different audiences. Configuration Manager administrators can create one or more MWs to prevent software from installing except during a specific period of time. End users can set Business Hours to indicate when they prefer software to install, ahead of the deadline, so that it doesn’t interrupt them during working hours. If you do not set a maintenance window, deployments are never prevented. Treat maintenance windows as a way of preventing deployments and holding them to specific time frames. 

Maintenance Windows

Maintenance windows help to make sure that client configuration changes occur during times that do not affect productivity. By default, computer restarts caused by a deployment are not allowed outside of a maintenance window. Admins can create packages or use client settings to override that and force a reboot should they choose to. Maintenance windows affect only the time when the deployment runs. Deployments that you configure to download and run locally can download content outside of the window.

The following tasks support maintenance windows:

• Application and package deployments

• Software update deployments

• Compliance settings deployment and evaluation

• OS and custom task sequence deployments

If a user installs an application from Software Center, the client starts it immediately. It prioritizes the user's intent over the administrator's.

If an administrator configures a deployment to ignore maintenance windows, it will start immediately. It prioritizes the administrator's intent over the user's.

Your Maintenance Windows

What are they set to? Most will have started with a default MW set to "Every Day 0000-0600", which means clients that are on during that time frame will be allowed to perform the tasks listed in the bullet points above. However, other maintenance windows can be selected and/or custom windows can be created. 

Things to keep in mind:

When creating maintenance windows or adding devices to an existing MW collection, if a deployment's maximum run time doesn't fit within the period, the deployment will not be enforced (i.e. it's not installed), so make sure the maintenance window is large enough for deployments to finish within the window. If your maintenance window is too short for an install to complete it will be scheduled at the next maintenance window. This could have cascading effects of being behind on updates if the maintenance window is short and has long gaps between the next (e.g. Two-hour window that occurs once a month).

EPM pre-creates multiple maintenance windows, if you have determined you want a longer maintenance window, you can add your device collection(s) to multiple maintenance windows and Configuration Manager will treat consecutive/overlapping windows as one single window. For example, if you added clients to "MW - Every Thursday 0000-0400" and to "MW - Every Thursday 0200-0600" it would be treated as a window running from midnight to six am. 

If devices are not powered on during a maintenance window, they cannot enforce deployments.  You can make different maintenance windows for different device collections. You know your users and your environment, choose windows that will be the least disruptive but don't make these windows so few and far between that systems aren't staying up to date.

Business Hours

IMPORTANT: The settings explained below are only available to users if custom client settings were created and the Options tab was made visible in Software Center. While most do not need to enable this option, it can be helpful to understand the concept of how it factors into deployments. 

This is the time frame in which a user does not want to be interrupted by an installation and reboot because they are working. The default for all computers is 5:00 AM through 10:00 PM, Monday - Friday. The combination of non-business hours and maintenance windows should be during periods of time when it's best to do software deployments because the system is expected to be powered on and "idle". 

Business hours puts some control into the user's hands in that they can choose to have updates defer to a later time so as to not interrupt work or they can have updates install as soon as business hours end (rather than waiting for a maintenance window) if they don't want installations to be pending longer than necessary. For example, they could change their business hours to 7 AM - 6 PM and check the box to automatically install required software, it they knew they only used that computer from 8-5. 

Deadline

If a deployment is Required, you can specify a deadline. This is the time that an installation will be enforced. A user is not able to postpone software to be installed after a deadline (business hours are ignored). Deadlines are designed to provide a guarantee that software will be installed. The default deadline is as soon as possible. Maintenance Windows are still respected unless a deployment was specifically set to be performed outside the maintenance window.

For example, if you need to deploy a new application and all users need to have it installed it by a certain time, you will then want to set a deadline. However, if you want to give users the opportunity to install the software before the deadline, you could schedule the application to be available before the deadline. You could for example schedule the available date to be 5/1/2022 but schedule the deadline to be 6/1/2022, thereby giving users a month to opt in early. For those users that do nothing, the software will install when the deadline is met. 

What can cause a deadline to be missed?

• The computer was not active (off/sleeping) at the time the deadline was reached.
• A maintenance window was scheduled for the machine and the deadline was reached before the maintenance window was available. The client will wait for the next maintenance window.

Deadline enforcement with a grace period

You might want to give users more time to install required applications beyond any deadlines you set. This behavior might be preferred if devices could be turned off for a long time, and needs to install many applications. For example, when a user returns from vacation or they left their laptop off for some time, they would have to wait for a long time as the client installs overdue deployments. To help solve this problem, define an enforcement grace period.

• First, configure this grace period with the property Grace period for enforcement after deployment deadline (hours) in client settings. Specify a value between 1 and 120 hours.

• On the Scheduling page of a required application deployment, enable the option to Delay enforcement of this deployment according to user preferences, up to the grace period defined in client settings. The enforcement grace period applies to all deployments with this option enabled and targeted to devices to which you also deployed the client setting.

After the deadline, the client installs the application when it reaches the first non-business window, (default 10 PM), up to this grace period. However, the user can still open Software Center and install the application at any time. Once the grace period expires, enforcement reverts to normal behavior for overdue deployments.

Why aren't my systems updating?

You will likely run into the issue of some or maybe even many of your systems not updating. This doesn't necessarily mean that something is broken or that Configuration Manager isn't doing its job. Here's an example of what could happen.

Let's say you've set a deadline of Wednesday at noon for deployment of an Adobe Acrobat update. You might be expecting systems to start installing your software, but while the computer sees the deadline has been reached it then checks to see if there's a maintenance window. It looks and sees that there's a maintenance window set from midnight to six am, so it's going to wait for that window. Now let's say it's 5'oclock and a user turns off their computer or maybe they leave it on but Acrobat is open. With the computer that is turned off, well simply put the computer is going to miss that window because it's off. If it later is turned on at 7am the client will see that it is outside the window and will wait for the next one. What about the other computer that stayed on with the software open? There's a good chance that because the software to be updated is open, it's going to fail to install the update. In both examples the client would continue to try at the next maintenance window until successful.

What can exacerbate the issue?

Having long gaps between maintenance windows. If you decided to create a monthly maintenance window (MW occurs once every 30 days) and a client is offline or misses the install for whatever reason, it won't try again until the following month. Even with a daily maintenance window, if your users turn off their computers before the MW happens, this could also lead to systems receiving few to no updates. 

What can you do about it?

There are several options that range from asking users to alter their habits to changing your maintenance windows to cater to your userbase. Exactly what might you change about your maintenance window? You can create multiple windows or expand your current window to encompass a time period where your systems are likely to be on, this will increase the chances that updates/software packages will be deployed successfully.

Devices that still do not appear to be updating even after making administrative changes, will require further investigation by local IT to rule out local device issues or if the device is off or being turned off.

Related Information

Microsoft | How to use maintenance windows in Configuration Manager

• Page:
  Common Tasks and Procedures (Endpoint Management)

  • configmgr
  • administration
• Page:
  Maintenance Windows and Business Hours (Endpoint Management)

  • configmgr
  • maintenance
  • administration
  • troubleshoot
• Page:
  Deploying Software Updates (Endpoint Management)

  • configmgr
  • administration
• Page:
  CM Deploying 3rd Party Updates to Collections (Patch My PC) (Endpoint Management)

  • configmgr
  • administration
  • updates
  • pmpc
• Page:
  3rd Party Updates List (Endpoint Management)

  • configmgr
  • administration
  • updates
  • pmpc
• Page:
  CM Client Settings (Endpoint Management)

  • configmgr
  • informational
  • administration
• Page:
  Recommended Practices (Endpoint Management)

  • configmgr
  • administration