Intune Autopatch with Script-Based Patch Verification

Intune Autopatch automates Windows, Microsoft 365 Apps, Edge, and Teams updates to improve security and productivity. To ensure patches are correctly applied and systems remain compliant, organizations can use Intune Proactive Remediations to detect missing patches and remediate them automatically. This guide provides a verifiable, end-to-end flow for engineers to implement and validate automated patching.

Introduction

Automated patching reduces administrative overhead and improves security posture by ensuring timely updates. Windows Autopatch manages update rings and cadence as a service, while Intune Proactive Remediations allow custom detection and remediation scripts to verify patch state and fix issues automatically.

Prerequisites

Licensing: Microsoft 365 Business Premium, Windows 10/11 Education A3/A5, Windows 10/11 Enterprise E3/E5 (including F3), or VDA equivalents.
Device platform: Windows 10/11 Enterprise/Education, Windows IoT Enterprise (certain LTSC limitations apply).
Network: Internet access to Intune, Windows Update, and Autopatch endpoints.

Step 1: Verify Prerequisites

Confirm licenses are assigned to users or devices. Ensure devices run supported Windows editions. Validate network connectivity to required endpoints (*.manage.microsoft.com, *.update.microsoft.com, etc.).

Step 2: Enroll Devices in Windows Autopatch

In the Microsoft Endpoint Manager admin center:

Navigate to Devices > Windows > Windows Autopatch > Enroll.
Select device groups (Entra groups) to enroll.
Confirm enrollment status in the Autopatch enrollment blade.

Step 3: Configure Update Rings (if needed)

Autopatch creates default Test and Last rings. Review them via Intune > Devices > Update rings.

Avoid assigning custom rings to Autopatch-managed devices; rely on service-managed policies.
Adjust ring settings (deferral, grace periods) only for opt-out groups.

Step 4: Deploy Proactive Remediation Script for Patch Verification

Create a detection script that checks for the latest quality update KB (returns exit code 0 if compliant, non-zero if action needed). Create a remediation script that triggers Windows Update or resets Windows Update components. Example detection script (PowerShell):

Powershell

# Check for KB500xxxx (example)
$hotfix = Get-HotFix -ID KB500xxxx -ErrorAction SilentlyContinue
if ($hotfix) { exit 0 } else { exit 1 }

Example remediation script (PowerShell):

Powershell

# Trigger Windows Update scan and install
usoclient StartScan
usoclient StartInstall
# Alternatively, reset Windows Update components
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

Deployment steps in Intune:

Upload detection and remediation scripts as a script package (Intune > Devices > Scripts).
Assign to targeting groups (can be the same Autopatch group or Entra group).
Set schedule (e.g., every 8 hours) and user context (System).
Enable notifications for failed detections.

Step 5: Monitor Compliance and Alerts

Monitor sources:

Intune device compliance and update compliance reports.
Windows Autopatch Management Status Report (tenant-wide view of eligible devices).
Windows Autopatch Alert Report (active alerts, severity, impacted update types).

Validation checks:

Detection scripts run on schedule to verify patch state.
Manual verification via Get-HotFix, Get-ItemProperty for registry keys, or WSUS/ConfigMgr queries.
Handling failed patches:
- Detection failure triggers remediation script (e.g., retry Windows Update, reset Windows Update components).
- If remediation fails, device marked non-compliant; admin can investigate logs (WindowsUpdate.log, SetupAPI.log).
- Rollback options: Use Windows Update for Business uninstall policies, or deploy a script to uninstall the problematic update via wusa.exe /uninstall.
Reporting and alerting:
- Configure alert rules in Intune for compliance drift.
- Use Autopatch alert email notifications or webhook integrations.
- Export reports to Power BI or Log Analytics for trend analysis.

Step 6: Remediate Failures and Verify Fixes

When detection fails, remediation script runs automatically.
Verify success by checking subsequent detection returns exit code 0.
If persistent failure, open ticket, collect logs, consider pausing the update ring for that device group.

Step 7: Review Reports and Adjust Policies

Weekly: Examine Intune update compliance trends.
Monthly: Review Autopatch reports for rollback/pause events.
Adjust ring deferrals or exclusion groups based on observed issues.
Update detection/remediation scripts as new KBs are released.

Sources

Windows Autopatch overview: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/overview/windows-autopatch-overview
Windows Autopatch prerequisites: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites
Manage Windows Update ring policies (Intune): https://learn.microsoft.com/en-us/intune/device-updates/windows/manage-update-rings
Update ring settings reference: https://learn.microsoft.com/en-us/intune/device-updates/windows/ref-update-ring-settings
Use Remediations to Detect and Fix Support Issues (Intune): https://learn.microsoft.com/en-us/intune/device-management/tools/deploy-remediations
PowerShell Scripts for Remediations reference: https://learn.microsoft.com/en-us/intune/device-management/tools/ref-remediation-scripts
Windows Autopatch alerts and remediations: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/monitor/alerts-remediations
Windows Autopatch management status report: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/monitor/windows-autopatch-management-status-report
Windows Autopatch groups overview: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview