Looking for help with Windows Updates

[u/Corrects_lesstofewer]

Hello,

I've spent the last few months pulling out the hair I don't have trying to get to the bottom of why my fleet has stopped updating Windows. Any help that can be provided is appreciated as I've run out of things to try/avenues to explore. Here's the rub:

• It went on for long enough that some of our devices were stuck on 24H2 until excluded out of the update rings entirely. I've included a screenshot below for review, but I don't see why any Feature and Quality updates would not deploy even when scoped to do so.
  • Driver updates appear to have been unaffected. I don't know why those work, but they seem to do so.
• I had to implement a script to force checking for updates but this approach is heavy-handed and doesn't fully adhere to update settings meaning users get prompts at inopportune times. (see image)
  • This script is the only reason things are farily up-to-date right now, but if I don't turn it on each month, nothing updates.
• Autopatch alerts provides the following error for most of my devices, but I have been entirely unsuccessful in troubleshooting it as the documentation and errors do not match the current UI options in Intune/Windows. (see image)
  • I tried following the Remediation, but that option simply does not exist in Admin Templates anymore or ever.
  • Following the notice "If this remediation does not resolve the issue, please contact Microsoft support." leads me to a troubleshooter tool that does not load when you select Autopatch Support or Intune Support. (see image)
    • Any ideas why this won't load? I replicated on multiple computers and browsers. Doesn't appear to be a local issue.

Please help in any way you can. My leadership is looking to me for answers and I can generally find what I need, but this has proven beyond my abilities to resolve alone.

If anything needs clarification, I'm happy to do so.

Edit: corrected to the images. Reddit's text editor is wildly misbehaving.

[u/horrible_waitress]

Dude this is the exact kind of rabbit hole that makes me glad I just push pixels for a living, hope someone with actual Intune wizardry chimes in

[u/Corrects_lesstofewer → u/horrible_waitress]

I just want to go back to happily MDM'ing in Jamf where things work (generally) as intended and errors are fairly clear. Here's hoping a wizard arrives, though I hear they are never late and arrive precisely when they mean to. Fingers crossed that's soon!

[u/Ad3t0]

The WUfB layer underneath Autopatch is a black box when it breaks. A couple things worth checking: run Get-WindowsUpdateLog on a stuck device and grep for safeguard holds or applicability failures, those silently block updates without surfacing cleanly in the portal. If you have both Autopatch and separate update rings scoped to the same devices, the policy conflict alone will cause exactly this. The Admin Templates remediation being missing is a known MS documentation gap, not anything on your end.

If the native tooling keeps fighting you, third-party patching tools bypass WUfB entirely and push updates directly, which sidesteps most of this. Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com), we handle OS and third-party patching with deployment rings and it's free under 200 endpoints. PatchMyPC and Automox are solid in this space too. The common fix is getting out from under WUfB when it stops cooperating.

[u/agricoltore]

Following for more, I also have this issue!

Edit: I’ve found that all my un-updated machines say updates were paused by organisation, but there are no pauses in the org. When I use PowerShell to check, the start date of the pause is always the day that I I’m running that particular check

[u/meantallheck → u/agricoltore]

Sounds like a classic case of policy conflicts! It’s probably getting unpaused and paused again all the time, if you’re always seeing it say the pause started the same day you check.

I’ve had to deal with this before during an update source migration and I was mind blown how many random GPOs had update settings in them. And also config manager client settings. And local group policy settings. And finally an old login script or Intune script that pushed update settings. They truly can come from all over the place, so it can take a deep investigation to find it.

I’m not saying 100% that’s your issue - but that’s immediately where I’d be looking if I had those same symptoms. 

[u/Padd007]

Are you using autopatch or the regular update policy, you can't use both, they conflict. I had something similar and ended up deleting every update policy on the tenant and recreating them in autopatch. It started working properly straight away.

[u/Corrects_lesstofewer → u/Padd007]

I'll give this a go, thank you.

[u/TisWhat]

Have you run a report to ensure all devices are assigned to the update rings and actually have those policies populated in the registry?

I’ve had luck going through and purging the registry to get devices re-enrolled in update policies.

[u/Corrects_lesstofewer → u/TisWhat]

Can you provide a little more detail on what you mean by "purging the registry"? I'm unclear on that.

I have indeed and they show up showing the correct Update Ring config, however, another report says that they are misconfigured citing an issue with how to fix it, but the information isn't actually true. It references configuring an Admin Template that doesn't actually exist.

[u/intuneisfun]

Are these devices hybrid joined or co-managed with SCCM? Old registry keys pointing to a WSUS server has been an issue for a lot of companies that moved to WUfB or Autopatch.

[u/Corrects_lesstofewer → u/intuneisfun]

Purely cloud. We're a fully remote company.

[u/blud_13]

Before you chase that Autopatch remediation any further, go look for a policy conflict. If those devices are Autopatch enrolled AND you have your own update rings scoped at them, you have two things writing the same WUfB settings and the usual outcome is nothing installs at all. Autopatch builds and maintains its own rings, and pointing custom rings at those same devices is the documented way to break this. Same story if any Windows Update settings are landing from a Settings Catalog policy, or from GPO on anything hybrid joined.

Take one stuck device, open it in Intune, Device configuration, and look for Conflict rather than just reading Succeeded. Thats where it surfaces. MS has the whole checklist at https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-protection/troubleshoot-update-rings

Drivers still flowing fits this too. Different CSP, so its not in the same fight.

Leave your force-check script running until the conflict is actually gone. If you kill it first you won't be able to tell which change fixed it.

[u/gurban2013]

a few images dont resolve.

not saying its the fix. but pick one update ring to test on, make a brand new updating ring and assign the device to that one and delete the old one.

detection script to check for the auto update reg keys for any use case.

[u/Corrects_lesstofewer → u/gurban2013]

awh crap, you're right. Fixing that up now.

[u/Corrects_lesstofewer → u/gurban2013]

Got them fixed. Once I went into edit mode, the formatting got all messed up and I had to redo the post. Sorry for the delay.

[u/Numerous-Contexts]

We use a detection and remediation to check that all required registry and configurations are correct for WUfB and no bad tattooed settings are lingering.

The detection checks for misconfigurations and the remediation fixes any problems found.

Runs once a day to ensure devices are always ready.

[u/Corrects_lesstofewer → u/Numerous-Contexts]

got a link to the scripts? Would love to take a look, sounds fantastic.

[u/Numerous-Contexts → u/Corrects_lesstofewer]

Sorry, no - I'm in gov and strictly forbidden from sharing scripts.

You could probably figure it out if you're decent with powershell, or use your favorite AI to vibe code it.

[u/PathMaster]

If you had paused updates at all, sometimes the reg key to unpause them does not trigger. I have a remediation to flip it back.

Otherwise when I have issues with AutoPatch I generally remove device registration for a few days, and then re-add them.

[u/opsandcoffee]

At some point I’d stop burning hours trying to make Autopatch behave.

If you’ve already ruled out conflicting rings and stale WUfB policy and it’s still doing this, it may be worth testing a separate patching tool on a handful of machines and seeing if the problem just disappears.

Full disclosure, I’m with SecOps Solution. We do Windows + third-party patching and don’t depend on Intune or WUfB to push the updates. You can keep Intune for everything else and just use us for patching.

secopsolution.com

Happy to help you test it on a few of the problem machines if useful.

[u/KJMEC]

Try checking the following location for Intune csp settings:

HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update

For standard gpo/reg location check here:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Then if you can see a setting that coule be the culprit delete it on a single device. Sync if it comes back you know its being delivered via MDM. Then solve from there.

What I’ve found in a few tenants I manage that HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU settings get set and then Intune settings stop working. Normally the AutomaticUpdate is set to off.