Patches for vulnerabilities in the operating systems of workstations are applied within one month of release

Contributed by jusso-devAll contributors →

Part of ASD · Intune · Device configuration · All checks

Run this check

Invoke-Maester -TestId ASD.ISM-1695

Overview

Patches, updates or other vendor mitigations for vulnerabilities in the operating systems of workstations are applied within one month of release (ISM-1695, Essential Eight Maturity Level One).

A workstation that defers quality updates with no deadline installs them when the user chooses, which may be never. A Windows update ring with a deadline makes installation and restart compulsory after a set number of days. This check reads the update rings in Intune and passes when at least one assigned ring does not pause quality updates, sets a deadline, and the deferral period, deadline and grace period add up to no more than 30 days (the MaximumDays parameter). Rings managed by Windows Autopatch, or devices patched by another tool, are not read.

Remediation action

1. In Microsoft Intune admin center, go to Devices > Windows > Update rings for Windows 10 and later and open the ring assigned to your workstations, or create one.
2. Under Update settings, set Quality update deferral period (days) to a small value, 0 to 7.
3. Under Deadline settings, set Use deadline settings to Allow, Deadline for quality updates to a value that keeps deferral, deadline and grace period within 30 days (for example 7), and Grace period to 2.
4. Assign the ring to all workstations.

Related links

• Essential Eight maturity model
• ASD Patching applications and operating systems
• Windows update rings policy in Intune

Details

Every attribute of this check

Field	Value
Test ID	ASD.ISM-1695
Severity	High
Suite	ASD
Product	Intune
Feature	Device configuration
Area	Devices and endpoints
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1203 Exploitation for Client Execution, T1068 Exploitation for Privilege Escalation
Supports benchmark	ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1695
Benchmark level	ML1
Essential Eight strategy	Patch operating systems
Supports controls	essential-eight:ISM-1695, nist-800-53-r5:SI-2(3), ism:ISM-1695
PowerShell test	Test-MtAsdWorkstationPatchDeadline
Services	Graph
Compatible licenses	INTUNE_A

Source

• Test: tests/asd/intune/Test.ASD.ISM-1695.ps1
• Documentation: tests/asd/intune/Test.ASD.ISM-1695.md