Start by ensuring your WSUS server can download and distribute KB5079391. Open the WSUS Administration Console and navigate to the synchronization settings.

# Open WSUS Console or use PowerShell
Get-WsusServer | Get-WsusSubscription | Start-WsusServerSynchronization

Navigate to Options > Products and Classifications. Ensure these are selected:

• Products: Windows 11, version 24H2 and later versions
• Classifications: Security Updates, Critical Updates, Update Rollups

Force a manual sync by going to Options > Synchronization Schedule > Synchronize Now. This process typically takes 15-30 minutes depending on your connection.

Establish deployment rings to control the rollout pace. In WSUS Console, navigate to Computers > All Computers and create new computer groups.

Right-click All Computers > Add Computer Group and create these groups:

• Pilot Ring - 5-10% of your environment
• Early Adopters - 25% of remaining systems
• Broad Deployment - All remaining production systems

Configure Group Policy to automatically assign computers to these groups. Create a new GPO called "WSUS Computer Group Assignment":

# Navigate to: Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks
# Create a startup script that runs:
wuauclt /detectnow
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v TargetGroup /t REG_SZ /d "Pilot Ring" /f

Link this GPO to your pilot OU containing test machines. Create similar GPOs for other rings with appropriate TargetGroup values.

Create a comprehensive Group Policy to control how clients interact with your WSUS server. Open Group Policy Management and create a new GPO called "Windows Update - WSUS Configuration".

Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update and configure these settings:

Specify intranet Microsoft update service location:
- Enabled
- Intranet update service: http://your-wsus-server:8530
- Intranet statistics server: http://your-wsus-server:8530

Configure Automatic Updates:
- Enabled
- Configure automatic updating: 4 - Auto download and schedule install
- Scheduled install day: Every day
- Scheduled install time: 03:00

Allow signed updates from an intranet Microsoft update service location:
- Enabled

Do not connect to any Windows Update Internet locations:
- Enabled

For deployment ring control, configure these additional settings:

Select when Preview Builds and Feature Updates are received:
- Enabled
- Windows readiness level: Semi-Annual Channel
- Defer feature updates: 365 days (for production rings)

Select when Quality Updates are received:
- Enabled
- Defer quality updates: 0 days (Pilot), 7 days (Early), 14 days (Broad)

Now approve the update for your pilot ring. In WSUS Console, navigate to Updates > All Updates and locate KB5079391. You can filter by "Security Updates" and "Unapproved" status to find it quickly.

Right-click KB5079391 and select Approve. In the approval dialog:

• Select Pilot Ring computer group
• Choose Approved for Install
• Set deadline: 7 days from now
• Leave other groups as "Not Approved"

# Alternative: Use PowerShell for approval
$wsus = Get-WsusServer
$update = $wsus.GetUpdates() | Where-Object {$_.KnowledgebaseArticles -contains "5079391"}
$pilotGroup = $wsus.GetComputerTargetGroups() | Where-Object {$_.Name -eq "Pilot Ring"}
$update.Approve("Install", $pilotGroup)

Monitor the approval process in Update Services > Server Name > Updates > Update Status Summary. You should see the update move from "Unapproved" to "Approved" status.

Monitor the pilot deployment closely for the first 48-72 hours. Use WSUS reporting and PowerShell to track installation progress and identify issues.

Generate installation reports in WSUS Console:

1. Navigate to Reports > Update Reports > Update Status Summary
2. Select KB5079391 and Pilot Ring computer group
3. Run the report to see installation status breakdown

Use PowerShell to check installation status across pilot machines:

# Check update installation status on remote machines
$pilotComputers = @("PC001", "PC002", "PC003")  # Replace with actual hostnames
foreach ($computer in $pilotComputers) {
    try {
        $hotfix = Invoke-Command -ComputerName $computer -ScriptBlock {
            Get-HotFix | Where-Object {$_.HotFixID -eq "KB5079391"}
        }
        if ($hotfix) {
            Write-Host "$computer: KB5079391 installed on $($hotfix.InstalledOn)" -ForegroundColor Green
        } else {
            Write-Host "$computer: KB5079391 not installed" -ForegroundColor Yellow
        }
    } catch {
        Write-Host "$computer: Connection failed - $($_.Exception.Message)" -ForegroundColor Red
    }
}

Monitor for common issues like system freezes or application compatibility problems. Create a feedback collection process using:

• Event Viewer logs (System and Application)
• User-reported issues through helpdesk tickets
• Automated health checks via PowerShell scripts

After confirming pilot success (typically 5-7 days), expand deployment to your Early Adopters ring, then to Broad Deployment. Return to WSUS Console and modify the approval for KB5079391.

Right-click KB5079391 and select Approve. Update the approval settings:

• Early Adopters: Approved for Install with 5-day deadline
• Keep Pilot Ring as approved
• Leave Broad Deployment as "Not Approved" for now

Use PowerShell to automate the phased rollout:

# Approve for Early Adopters ring
$wsus = Get-WsusServer
$update = $wsus.GetUpdates() | Where-Object {$_.KnowledgebaseArticles -contains "5079391"}
$earlyGroup = $wsus.GetComputerTargetGroups() | Where-Object {$_.Name -eq "Early Adopters"}
$update.Approve("Install", $earlyGroup)

# Set deadline (optional)
$deadline = (Get-Date).AddDays(5)
$update.Approve("Install", $earlyGroup, $deadline)

Monitor Early Adopters deployment for 3-5 days, then proceed to Broad Deployment if no issues arise. For the final phase:

# Final approval for Broad Deployment
$broadGroup = $wsus.GetComputerTargetGroups() | Where-Object {$_.Name -eq "Broad Deployment"}
$update.Approve("Install", $broadGroup)

Track overall deployment progress using WSUS reports. Generate weekly status reports showing installation percentages across all rings.

Prepare automated rollback capabilities before broad deployment. Create PowerShell scripts and Group Policy configurations to quickly remove KB5079391 if critical issues emerge.

Create a rollback script that can be deployed via Group Policy startup scripts:

# Save as Remove-KB5079391.ps1
param(
    [switch]$Force,
    [switch]$NoRestart
)

# Check if update is installed
$update = Get-HotFix | Where-Object {$_.HotFixID -eq "KB5079391"}
if (-not $update) {
    Write-Host "KB5079391 not found on this system" -ForegroundColor Yellow
    exit 0
}

try {
    Write-Host "Removing KB5079391..." -ForegroundColor Yellow
    
    # Method 1: Using wusa.exe
    $process = Start-Process -FilePath "wusa.exe" -ArgumentList "/uninstall /kb:5079391 /quiet $(if($NoRestart){'/norestart'})" -Wait -PassThru
    
    if ($process.ExitCode -eq 0) {
        Write-Host "KB5079391 removed successfully" -ForegroundColor Green
        
        # Log the removal
        $logEntry = "$(Get-Date): KB5079391 removed from $env:COMPUTERNAME"
        Add-Content -Path "C:\Windows\Temp\KB5079391_Removal.log" -Value $logEntry
        
        if (-not $NoRestart) {
            Write-Host "System will restart in 60 seconds..." -ForegroundColor Yellow
            shutdown /r /t 60 /c "KB5079391 removal requires restart"
        }
    } else {
        throw "wusa.exe failed with exit code $($process.ExitCode)"
    }
} catch {
    Write-Error "Failed to remove KB5079391: $($_.Exception.Message)"
    exit 1
}

Deploy the rollback script via Group Policy when needed:

1. Copy the script to SYSVOL: \domain.com\SYSVOL\domain.com\scripts\
2. Create a new GPO called "Emergency KB5079391 Rollback"
3. Navigate to Computer Configuration > Windows Settings > Scripts > Startup
4. Add the PowerShell script with appropriate parameters

For immediate rollback across multiple systems, use PowerShell remoting:

# Emergency fleet rollback
$computers = Get-ADComputer -Filter "OperatingSystem -like '*Windows 11*'" | Select-Object -ExpandProperty Name
Invoke-Command -ComputerName $computers -ScriptBlock {
    wusa.exe /uninstall /kb:5079391 /quiet /norestart
} -ThrottleLimit 10

Establish comprehensive monitoring and reporting for the entire deployment lifecycle. Create automated reports that track installation progress, failures, and system health post-deployment.

Set up automated WSUS reporting using PowerShell:

# Create daily deployment status report
$wsus = Get-WsusServer
$update = $wsus.GetUpdates() | Where-Object {$_.KnowledgebaseArticles -contains "5079391"}

# Get installation statistics
$groups = $wsus.GetComputerTargetGroups()
$report = @()

foreach ($group in $groups) {
    if ($group.Name -in @("Pilot Ring", "Early Adopters", "Broad Deployment")) {
        $computers = $group.GetComputerTargets()
        $total = $computers.Count
        
        $installed = 0
        $failed = 0
        $pending = 0
        
        foreach ($computer in $computers) {
            $status = $computer.GetUpdateInstallationInfoPerUpdate($update)
            switch ($status.UpdateInstallationState) {
                "Installed" { $installed++ }
                "Failed" { $failed++ }
                "NotInstalled" { $pending++ }
            }
        }
        
        $report += [PSCustomObject]@{
            Group = $group.Name
            Total = $total
            Installed = $installed
            Failed = $failed
            Pending = $pending
            SuccessRate = if($total -gt 0) { [math]::Round(($installed / $total) * 100, 2) } else { 0 }
        }
    }
}

# Generate HTML report
$html = $report | ConvertTo-Html -Title "KB5079391 Deployment Status" -PreContent "
KB5079391 Deployment Report - $(Get-Date)
"
$html | Out-File "C:\Reports\KB5079391_Status_$(Get-Date -Format 'yyyyMMdd').html"

Create a monitoring dashboard that tracks:

• Installation success rates by deployment ring
• Failed installations with error codes
• System stability metrics post-installation
• Help desk ticket volume related to the update

Set up email alerts for critical thresholds:

# Alert if failure rate exceeds 5%
foreach ($ring in $report) {
    $failureRate = if($ring.Total -gt 0) { ($ring.Failed / $ring.Total) * 100 } else { 0 }
    
    if ($failureRate -gt 5) {
        $subject = "ALERT: High KB5079391 failure rate in $($ring.Group)"
        $body = "Failure rate: $failureRate% ($($ring.Failed)/$($ring.Total) systems)"
        Send-MailMessage -To "admin@company.com" -Subject $subject -Body $body -SmtpServer "mail.company.com"
    }
}