Skip to content

Windows Update | Harden System Security

Windows Update - Harden Windows Security GitHub repository


Windows updates are extremely important. They always should be installed as fast as possible to stay secure and if a reboot is required, it should be done immediately. Threat actors can weaponize publicly disclosed vulnerabilities the same day their POC (Proof-Of-Concept) is released..

In Windows by default, devices will scan daily, automatically download and install any applicable updates at a time optimized to reduce interference with usage, and then automatically try to restart when the end user is away.

The following policies the app configures make sure the default behavior explained above is tightly enforced.


  • Blue Check mark denoting Group Policy Enables "Receive Updates for other Microsoft products" (such as PowerShell)


  • Rotating pink checkmark denoting registry or cmdlet Enables "Notify me when a restart is required to finish updating". Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Specifies the number of days before quality updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Specifies the number of days before feature updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the number of grace period days before feature updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the number of grace period days before quality updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the automatic updates to happen every day, automatically be downloaded and installed, notify users for restart. Rotating green checkmark denoting CSP CSP