INTUNE-006: Windows Update for Business ring configuration
- Plataforma
- Entra ID / M365
- Categoría
- Intune / Endpoint Management
- Severidad
- High
- Pilar de Zero Trust
- Devices (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Windows Update for Business rings control the cadence and deferral periods for quality and feature updates on managed Windows devices. Misconfigured update rings can result in devices running outdated builds with known vulnerabilities for extended periods. Properly staged update rings balance operational stability with timely security patching.
Valor recomendado
Quality updates deferred no more than 7 days; feature updates deferred no more than 60 days; all rings assigned and actively delivering updates
Remediación
Review all Windows Update for Business ring configurations and verify that quality update deferral periods do not exceed 7 days for security-critical rings. Ensure that at least a pilot and broad deployment ring exist with appropriate deferral staging. Monitor update compliance reports to identify devices that have not installed recent updates and investigate any update failures or stalled installations.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2