[Windows 10 Mobile] Deleted member 7503076:
I've written this up in case of interest - reasons you might want to use WSUS include if you want to manage or update multiple Windows 10 Mobile devices or if you want complete control over what build you update to and when (rather than just getting the latest supported one when MS decide is time).

Also I suspect the "defer upgrades" trick to get Threshold 2 (10586.xxx) updates on the older unsupported Lumias may stop working once Redstone 1 makes its way down to the Current Branch for Business later this year, so I was keen to test this out to be sure that it will still be possible to update a device from Windows Phone 8.1 or Windows 10 Mobile 10586.xxx to the latest 10586.xxx build (currently 10586.839 - March 2017) perpetually, whatever Microsoft do (the iutool method of installing the update never worked for me - it works for getting the initial 10586.107 upgrade from 8.1 though).

If WSUS is for you, here's what you need to do:

(1) I will assume you are starting with a fresh copy of Windows Server 2012 R2 as this is what I used - other versions of Windows Server will be similar and can also be used though. Just download the trial version from Microsoft if you don't have a licence key for a suitable version of Windows Server, and install it in a VM.

(2) Open Server Manager (Control Panel > Administrative Tools > Server Manager) - in there choose Manage > Add Roles and Features from the top-right menus. Click Next until you reach a list of available roles; tick "Windows Server Update Services" and accept the prompt to add required dependencies if it appears. Continue to click Next to complete the wizard and install the WSUS role. The default settings are all fine if you will be using the Windows Internal Database. Ensure that you choose the option to download updates locally and enter a suitable folder path for these to be saved to (otherwise if MS ever remove the updates from Windows Update, your WSUS server will be useless!)

(3) Once it has finished installing, open Control Panel > Administrative Tools > Windows Server Update Services. This will complete the post-installation configuration the first time it is run. Click through the initial wizard - again all the default options should be fine. Click "Start connecting" when prompted and wait for it to download all the information about the available updates from Windows Update, this seems to take quite a while so be patient! Once the Next button is no longer greyed out, click it.

(4) Next you have to choose what products and languages your WSUS server will be used for. I don't think this actually matters as Windows 10 Mobile updates don't seem to be an option here anyway and we will instead be importing the relevant update(s) from the Microsoft Update Catalogue later on - I chose English, Windows 10, and all types of updates here.

(5) Choose whether to synchronise the details of available updates manually or automatically - I chose manually given that we will be manually adding the update from the Microsoft Update Catalogue anyway.

(6) The WSUS server is now ready so we now need to create a provisioning package to configure your phone(s) to use it when checking for updates, rather than Microsoft's servers. https://blogs.technet.microsoft.com...ge-to-upgrade-to-windows-10-mobile-enterprise covers doing this, you can either use the same package as your one to upgrade to Enterprise edition (WSUS can only be used with Windows 10 Mobile Enterprise) or a separate one. Essentially to create the package you need to install the Windows Imaging and Configuration Designer (download from https://msdn.microsoft.com/en-us/windows/hardware/dn913721.aspx#adkwin10 - I'm using the 1511/Threshold 2 version), tick just the ICD part and allow it to select the prerequisite parts:

View attachment 4078600

Once installed, run Windows Kits > Windows Imaging and Configuration Designer from the Start Menu, select "New Provisioning Package" from the opening screen, and enter a name for it (I called mine "WSUS"). Select "Common to all Windows mobile editions" on the next screen, then on the next screen click Finish without importing anything.

Once the empty package has been created,in the left-hand tree expand Runtime Settings > Policies > Update, and select "UpdateServiceUrl". In the centre pane, enter http:// followed by your WSUS server's name and port number - in this example the server is called VM-WSUS and the port number is the default WSUS port of 8530:

View attachment 4078601

Once you have added all of the customisations that you want, go to Export > Provisioning Package at the top and save the package (again I just called it "WSUS").

(7) Copy the resulting package(s) to your phone e.g. via USB cable (any location is fine, I chose the Downloads folder), and select the prompt that appears to apply it. Note that you must do the Enterprise upgrade one first if you were not already running Enterprise edition, and you only need the .ppkg file, not the .cat file that it also creates.

(8) Once it has been applied, on the phone go to Settings > Update and Security > Phone Update. If you are on the Threshold 2 branch you must tick the "Defer upgrades" box under "advanced options", the more recent Threshold 2 updates (i.e. those released since Redstone) will only install on devices where this is set. Then press the button to check for updates. To check it is connecting to your WSUS server and not to Microsoft's servers, ensure you see the tickbox to check with Microsoft instead - this confirms it is configured to use WSUS (like how when a desktop PC is configured to use WSUS). At this stage it should say no updates are available as we haven't yet added any relevant updates to WSUS. If it says it "can't connect to the update service" or you don't see the box to check online instead, then something has gone wrong with the above steps.

View attachment 4078602

Just ensure this box is there; don't tick it if you want to get your updates from your WSUS server!

The phone should also appear under Computers on the WSUS server once it has checked in for the first time.

(9) Next we need to add the update(s) that we want - back on your WSUS server, continuing in Control Panel > Administrative Tools > Windows Server Update Services, click "Updates" in the left-hand tree and then click "Import updates" in the right-hand Actions" pane. This opens Internet Explorer and prompts you to install an ActiveX control. Once done, search for the update you want - they can be tricky to find, generally searching for "xxx mobile" where xxx is the part of the build number after 10.0.10586 will get you the more recent Threshold 2 updates; you will need to do your own research if you want a different update. I don't know why they have a different main build number rather than 10586.

For example:

10.0.10586.839 (March 2017 cumulative update for W10M, Threshold 2 branch): https://www.catalog.update.microsoft.com/Search.aspx?q=839 mobile

Click "Add" next to the larger update, then click "View basket" at the top - then click "Import". This will add the update to WSUS but won't actually download the files for it yet.

View attachment 4078603

(10) Once it says it has finished, go back to Control Panel > Administrative Tools > Windows Server Update Services, select Updates > All Updates in the left-hand tree and change the filter at the top to a status of "Any", then click Refresh. Your update should be shown - click on it, then in the right-hand Actions pane click "Approve". Click the "no" symbol to the left of "All Computers" and select "Approved for Install" - the "no" symbols should change to ticks:

View attachment 4082579

(you will see that you can check the "correct" build number of the update in the Description section towards the bottom of the window - highlighted above)

View attachment 4078605

(11) Wait for the update (around 2.5 GB as it is cumulative and contains the files for all mobile devices) to be downloaded into WSUS - you can see how it is doing by clicking on the name of your WSUS server in the left-hand tree view. If it is very slow you may want to change the settings in gpedit.msc under Computer Configuration > Administrative Templates > Network > Background Intelligent Transfer Service > Limit the maximum network bandwidth for BITS Background Transfers.

(12) Once it is fully downloaded, check for updates on your phone again. With any luck, you will see the update begin to download from your WSUS server!

Hope this helps and/or is interesting, feel free to post below how you get on! :) I've tested updating a Lumia 625 straight from 10586.107 all the way to 10586.839 with this, you only need the one update as they are cumulative.