Skip to content

Windows Update | Harden System Security

Windows Update - Harden Windows Security GitHub repository


Windows updates are extremely important. They always should be installed as fast as possible to stay secure and if a reboot is required, it should be done immediately. Threat actors can weaponize publicly disclosed vulnerabilities the same day their POC (Proof-Of-Concept) is released..

In Windows by default, devices will scan daily, automatically download and install any applicable updates at a time optimized to reduce interference with usage, and then automatically try to restart when the end user is away.

The following policies the app configures make sure the default behavior explained above is tightly enforced.


  • Blue Check mark denoting Group Policy Enables "Receive Updates for other Microsoft products" (such as PowerShell)


  • Rotating pink checkmark denoting registry or cmdlet Enables "Notify me when a restart is required to finish updating". Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Specifies the number of days before quality updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Specifies the number of days before feature updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the number of grace period days before feature updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Sets the number of grace period days before quality updates are installed on devices automatically to 1 day. Rotating green checkmark denoting CSP CSP


  • Blue Check mark denoting Group Policy Configures the automatic updates to happen every day, automatically be downloaded and installed, notify users for restart. Rotating green checkmark denoting CSP CSP



Management

Windows Update - Harden Windows Security GitHub repository


The management tab is designed to show available Windows updates that are not currently installed. Users can retrieve the available update list, inspect detailed metadata for each update, hide or unhide selected updates, sort updates by deployment date and export update metadata to JSON.

Tip

When you or Windows itself checks for updates, there is no way to select which ones you want to install and which ones you don't want, but now with this new feature, you have that option. This also means that if someone, some other software or even malware has hidden important security updates on your system, you can now view them in this management page and unhide them.

Being able to hide updates is useful in some scenarios, for example when a specific update is causing issues and you want to prevent it from being installed until a fix is released, or when Windows Update offers an old driver version even if newer version is installed. Each hidden update can be shown again easily via the UI controls.

Updates available in Windows carry a lot of metadata with them but Windows Update in Windows Settings only displays a tiny fraction of it. The management tab in the app allows users to inspect all the metadata for each update, which can be useful to understand what the update is about, its severity, whether it's a security update or not, the link to online articles and so much more. You can also instantly export them to JSON file, which can be useful for further analysis or record-keeping.