Keeping Windows systems updated is crucial for maintaining security across various organizations. However, the methods for installing updates can vary based on factors such as company size, infrastructure, and the number of machines. Common approaches include manual updates, Group Policies (GPO), Windows Update Service (WSUS), scripts, and third-party patch management solutions.

Challenge

A significant challenge in managing Windows updates, whether on physical PCs or virtual machines (VMs), is ensuring compliance with security standards and regulations. These standards often mandate applying security updates to all managed systems within a specified timeframe, typically 30 days. However, IT administrators face obstacles when machines are offline for extended periods, making timely updates difficult to achieve.

This knowledgebase article aims to address the challenge by exploring how Parallels Desktop features can facilitate the maintenance of Windows VMs, ensuring they remain up-to-date and secure.

Maintain Windows updates in the deployed VMs

Configure Windows update settings

In addition to Parallels Desktop settings, IT administrators have the flexibility to configure various options within Windows based on your specific requirements and preferences. However, to ensure optimal performance and update management, there are some basic recommended configurations: ensure that Windows Update is enabled and set to automatically download and install updates, define active hours within Windows Update settings to prevent updates from interrupting user activity, and configure the time frame for which the end users can postpone the installation of the Windows Updates. 

By configuring these options, administrators can effectively maintain Windows VMs, ensuring they remain up-to-date and operational for optimal performance and security. Additionally, administrators can customize other settings as needed to align with their organization's requirements and preferences.

To ensure that Windows VMs remain up-to-date and operational using Parallels Desktop, administrators can implement specific configuration settings both through the graphical user interface (GUI) and via the command line interface (CLI). Additionally, it's important to configure certain options within Windows itself for optimal performance and update management. Here's a comprehensive guide.

Configure Windows before deployment

If you come across this topic when preparing a Windows VM image for further deployment to the end users' Macs with Apple silicon, then this knowledgebase article is a good source of information for you. As a reminder, our recommendations for Parallels Desktop and VM deployment are outlined here. If you need to manage those VMs granularly: enroll them into domains, activate Windows licenses, differentiate PC names, enforce specific policies, enable company-wide licensing tools, etc, we advise you to prepare the Windows image using Microsoft's Sysprep utility. You can dig into the details by visiting KB 129529. 

Once you complete all the steps inside the Windows VM including the steps to make Windows check for updates with the required frequency by applying GPO policies or by using any other methods, we advise you to configure the VM the way outlined below to make sure the pending updates will get installed at the scheduled time:

1. Open Parallels Desktop and select the Windows VM you wish to configure.
2. Navigate to the VM's configuration settings > go to the Options tab > Startup and Shutdown > select the settings as outlined in the screenshot below:

Additionally, you can restrict your users to change the virtual machine state to make sure the VM is always up and running, you can restrict this action with a custom password. Check this article to learn how to do this.

Once the image is ready, you can deploy it using the preferred deployment method. Learn more in the Parallels Desktop Business Edition Guide.

Configure Windows after the deployment

Based on the number of virtual machines you have to deal with, you can select one of the options below to apply additional configuration settings to the deployed VMs to make sure the Windows updates will get installed at the scheduled time.

Via GUI

If you choose this option, please note that you'll have to perform the steps below manually on every virtual machine.

1. Open Parallels Desktop and select the Windows VM you wish to configure.
2. Navigate to the VM's configuration settings > go to the Options tab > Startup and Shutdown > select the settings as outlined in the screenshot below:

Selecting these options helps you to ensure the Windows VM will remain active and the Windows updates will get installed at the configured time. 

Via CLI

You can use Parallels Desktop Command-Line Interface (CLI) to configure the startup and shutdown options of the Windows VM(s) on the target computers. You can create a script and push it to the target computer via your MDM solution or by using any other options that work best for you. An example of the script for a specific Windows VM is provided below:

where "VM_name" is the name of the VM to which the settings should be applied. The first command configures the VM to start automatically in 30 seconds after a user logs into their account on the Mac, the second one adjusts the VM to make it keep running in the background after closing the VM window, and the third one disables pausing of the VM in the idle state.

If you want to configure it for several VMs, you can use the script below:

Advanced configuration

If you want to restrict your users to change the virtual machine state to make sure the VM is always up and running, you can restrict this action with a custom password. Check this article to learn how to do this.

If you want to learn more about other Parallels Desktop commands, click here.