# Patches for vulnerabilities in the operating systems of workstations are applied within one month of release

Patches, updates or other vendor mitigations for vulnerabilities in the operating systems of workstations are applied within one month of release…

Source: https://maester.dev/docs/tests/ASD.ISM-1695

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jusso-dev" title="jusso-dev · Original author"><img src="https://github.com/jusso-dev.png" alt="jusso-dev" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jusso-dev">jusso-dev</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/asd">ASD</a> · Intune · Device configuration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ASD.ISM-1695
```

## Overview

Patches, updates or other vendor mitigations for vulnerabilities in the operating systems of workstations are applied within one month of release (ISM-1695, Essential Eight Maturity Level One).

A workstation that defers quality updates with no deadline installs them when the user chooses, which may be never. A Windows update ring with a deadline makes installation and restart compulsory after a set number of days. This check reads the update rings in Intune and passes when at least one assigned ring does not pause quality updates, sets a deadline, and the deferral period, deadline and grace period add up to no more than 30 days (the `MaximumDays` parameter). Rings managed by Windows Autopatch, or devices patched by another tool, are not read.

#### Remediation action

1. In **Microsoft Intune admin center**, go to **Devices** > **Windows** > **[Update rings for Windows 10 and later](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/windowsUpdate)** and open the ring assigned to your workstations, or create one.
2. Under **Update settings**, set **Quality update deferral period (days)** to a small value, 0 to 7.
3. Under **Deadline settings**, set **Use deadline settings** to **Allow**, **Deadline for quality updates** to a value that keeps deferral, deadline and grace period within 30 days (for example 7), and **Grace period** to 2.
4. Assign the ring to all workstations.

#### Related links

* [Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)
* [ASD Patching applications and operating systems](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/patching-applications-and-operating-systems)
* [Windows update rings policy in Intune](https://learn.microsoft.com/intune/intune-service/protect/windows-update-for-business-configure)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ASD.ISM-1695 |
| Severity | High |
| Suite | ASD |
| Product | Intune |
| Feature | Device configuration |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1203 Exploitation for Client Execution, T1068 Exploitation for Privilege Escalation |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1695 |
| Benchmark level | ML1 |
| Essential Eight strategy | Patch operating systems |
| Supports controls | essential-eight:ISM-1695, nist-800-53-r5:SI-2(3), ism:ISM-1695 |
| PowerShell test | [Test-MtAsdWorkstationPatchDeadline](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1695.ps1) |
| Services | Graph |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/asd/intune/Test.ASD.ISM-1695.ps1`](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1695.ps1)
- Documentation: [`tests/asd/intune/Test.ASD.ISM-1695.md`](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1695.md)