Windows Update policy is assigned and enforced

Overview

If Windows Update policies aren’t enforced across all corporate Windows devices, threat actors can exploit unpatched vulnerabilities to gain unauthorized access, escalate privileges, and move laterally within the environment. The attack chain often begins with device compromise via phishing, malware, or exploitation of known vulnerabilities, and is followed by attempts to bypass security controls. Without enforced update policies, attackers leverage outdated software to persist in the environment, increasing the risk of privilege escalation and domain-wide compromise.

Enforcing Windows Update policies ensures timely patching of security flaws, disrupting attacker persistence, and reducing the risk of widespread compromise.

Remediation

Start with Manage Windows software updates in Intune to understand the available Windows Update policy types and how to configure them.

Intune includes the following Windows update policy type:

• Windows quality updates policy - to install the regular monthly updates for Windows.
• Expedite updates policy - to quickly install critical security patches.
• Feature updates policy
• Update rings policy - to manage how and when devices install feature and quality updates.
• Windows driver updates - to update hardware components.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Devices
Category	Device management
Product	Intune
Feature	Device configuration
Area	Devices and endpoints
ATT&CK	T1203 Exploitation for Client Execution, T1068 Exploitation for Privilege Escalation, T1210 Exploitation of Remote Services
Licence	Intune
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.