# Windows Update policy is assigned and enforced
If Windows Update policies aren't enforced across all corporate Windows devices, threat actors can exploit unpatched vulnerabilities to gain unauthorized…
Source: https://maester.dev/docs/tests/ZTA.24553
## Overview
If Windows Update policies aren't enforced across all corporate Windows devices, threat actors can exploit unpatched vulnerabilities to gain unauthorized access, escalate privileges, and move laterally within the environment. The attack chain often begins with device compromise via phishing, malware, or exploitation of known vulnerabilities, and is followed by attempts to bypass security controls. Without enforced update policies, attackers leverage outdated software to persist in the environment, increasing the risk of privilege escalation and domain-wide compromise.
Enforcing Windows Update policies ensures timely patching of security flaws, disrupting attacker persistence, and reducing the risk of widespread compromise.
## Remediation
Start with [Manage Windows software updates in Intune](https://learn.microsoft.com/intune/device-updates/windows/configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to understand the available Windows Update policy types and how to configure them.
Intune includes the following Windows update policy type:
- [Windows quality updates policy](https://learn.microsoft.com/intune/device-updates/windows/manage-quality-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to install the regular monthly updates for Windows.*
- [Expedite updates policy](https://learn.microsoft.com/intune/device-updates/windows/expedite-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to quickly install critical security patches.*
- [Feature updates policy](https://learn.microsoft.com/intune/device-updates/windows/manage-feature-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Update rings policy](https://learn.microsoft.com/intune/device-updates/windows/manage-update-rings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to manage how and when devices install feature and quality updates.*
- [Windows driver updates](https://learn.microsoft.com/intune/device-updates/windows/manage-driver-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to update hardware components.*
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Device configuration |
| Area | Devices and endpoints |
| ATT&CK | [T1203](/docs/tests?mitre=T1203) Exploitation for Client Execution, [T1068](/docs/tests?mitre=T1068) Exploitation for Privilege Escalation, [T1210](/docs/tests?mitre=T1210) Exploitation of Remote Services |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.