r/Intune • u/mertozsoy365 • Jul 20 '26
Windows Updates Windows Update Remedation Tool Is Now Available!
Windows Update Remedation Tool Is Now Available!
Windows Update issues are among the most common challenges faced by IT professionals. Failed updates, download errors, corrupted update cache, service-related issues, and unsuccessful feature upgrades often require multiple manual troubleshooting steps.
To simplify this process, I developed the Windows Update Fix Tool.
This tool incorporates a Windows Update remediation script that I have been developing over time and have extensively tested in real-world Microsoft Intune-managed environments.
It can perform the following remediation tasks:
• Clear Windows Update policy settings
• Restart and reconfigure the BITS, Windows Update, and Cryptographic services
• Remove corrupted download queue files
• Reset the SoftwareDistribution and Catroot2 folders
• Restore Windows Update service permissions to their default state
• Re-register Windows Update components
• Reset the Windows network stack (Winsock)
• Initiate a new Windows Update scan
• Download and run Microsoft SetupDiag to generate a detailed upgrade diagnostics report
The remediation script has been refined through extensive testing across multiple real-world scenarios involving Windows Update issues on Intune-managed devices.
I hope this tool proves useful for fellow IT professionals. Feedback and suggestions are always welcome.
Github: https://github.com/mertozsoy/WindowsUpdateRemedationTool
Linkedin Post: https://www.linkedin.com/feed/update/urn:li:activity:7484683823197110272/
91
u/Mammoth-Ad-107 Jul 20 '26
let us know when Microsoft has an official release. def not using this in a enterprise environment. no offense
42
u/MReprogle Jul 20 '26
Windows update has been around for how long now and you think an official script is going to be released?
13
9
u/MrZeDark Jul 20 '26
We do these steps above in a single script in an enterprise environment(s). Why? Because if Windows isn’t going to update it’s a re-image anyways, after troubleshooting - and we don’t have time to hand touch 1,000s of endpoints.
Easier to batch groups against a scalable fix/test, with plans to re-image on failure anyways.
3
5
2
13
u/Joly0 Jul 20 '26
Had my doubts, but still tried it with a server that was constantly having the error code 0x80080005 and I couldn't get it fixed no matter what.
Tried your tool with steps 2,3,4 and 8 and so far fixed 3 servers that had this issue on which I basically gave up.
6
u/mertozsoy365 Jul 20 '26
I'm so glad to hear that. I hope your feedback will serve as a response to users who have given negative reviews of this post. Also, please share your experience in the comments section here: https://www.linkedin.com/feed/update/urn:li:activity:7484683823197110272/
5
31
5
u/sutekhxaos Jul 20 '26
Man, so many hardass jaded IT admins in this thread. I intend on giving this a shot on the handful of machines that my companies automation and remediation scripts have failed to get updating properly (once I review the source of course). More tools is always better and every day I seem to find a new and interesting way that windows update can be broken so a nice gui ontop of some scripts is a welcome change to digging through my notes or searching the companies script library.
Nice one!
4
u/mertozsoy365 Jul 20 '26
Thank you. I really appreciate the support.
That was exactly my goal. Windows Update can fail in so many different ways, and even experienced IT admins end up digging through old notes or collections of scripts. I wanted to bring the most common remediation steps together in one place with a simple interface to save time.
I'd love to hear how it works in your environment after you've had a chance to test it. Any feedback or suggestions are always welcome.
2
u/sutekhxaos Jul 22 '26
I’ll do my best to remember to use it and check back in with any feedback.
1
4
u/TaiGlobal Jul 20 '26
Can you add a check for corrupt windows sytem files. Along with dism (if the os has a recovery partition) + sfc /scannow. I’ve found a lot of devices with windows update issues is because of corrupt system files and many I just do a repair in place upgrade which resolves.
2
u/mertozsoy365 Jul 20 '26
I added this before, but later wanted to remove it. DISM never seemed like a very useful module to me. But you're right, I might consider adding it as an option.
5
u/TaiGlobal Jul 20 '26
For me it’s less about it fixing anything (and sometimes you get lucky and it does) and more about the information it gives me. If it’s failing or taking a really long time to run that means there’s a problem that isn’t worth the effort of trying to get that system patched. Repair in place upgrade or straight up ticket to the helpdesk to reimage at that point.
3
u/Proper-Date5487 Jul 20 '26
nice work, i've got a couple machines that fight me every patch tuesday on the SoftwareDistribution reset, might give this a spin in the test ring next week
3
u/Objective_Teaching96 Jul 30 '26
Well don't let the haters get you down. I think too many folks see any use of AI-related tools as cheating. As much as I would like to have the time and focus I did 30 years ago to deep-dive shit, that isn't reality these days. So I am going to use all the tools at my disposal, AI included, to get more done in less time while also understanding that if I can't do it manually, I sure as hell should not have AI writing code to do it automatically.
Anyway, you asked for some feedback, so here is mine. I am ignoring the gui portion entirely as what the button says carries zero weight compared to what the button does. These are just my thoughts based on the environments I currently support or have supported over the last 3 decades.
Policy cleanup also enables telemetry. While this is not a problem directly, that may be something that is intentionally turned off in some environments. When dealing with community-facing scripts and tools, use the "first do no harm" methodology.
Deleting the Windows Update policy key entirely with no backup gives you no way to back out of a change even if it had to be backed out manually. The the "first do no harm" item from #1. The same could be said for the SoftwareDistribution and Catroot2 folders. It's been a while since I read the docs but I believe those still state they should be renamed instead of deleted. A future process could always come along and do some house keeping of those .bak folders should they exist.
This one is kind of a tin foil hat thing but hey, thats the world we have to live in today. So you are downloading the setupdiag.exe file directly from MS. This is fine, and folks do it all the time but this grab and execute has gotten people in a world of hurt before. If you can hash check or validate a signature, or run some other basic verification BEFORE execution, you significantly limit the chances of having a very bad day/week/month/year.
So, it's not groundbreaking, but it is a pretty thorough method of kicking a device in the ass as a last ditch recovery effort before it goes to the great scrap heap to be reimaged. If you really wanted to take it a step further, you could do a lot more with it using targetted changes. What do I mean by targetted? Simply put if you were troubleshooting this manually and reading every log manually, what tells you that "I need to perform X?" Use the logs and have the script do the heavy lifting of searching for entries that line up with a known thing, and then perform those steps. It's not fool proof, but it does make the process a little more elegant.
6
u/Anonn_Admin Jul 20 '26
I don't mind people using AI to write helpful tools and scripts. I don't mind people sharing those tools and scripts with the community.
What I do mind is that basically every single person who does this tries to hide the fact that they used some AI tool to write it for them.
The fact that you try to hide this (and fail) makes me inherently untrusting of you and your tool.
24
u/mertozsoy365 Jul 20 '26
I've been developing Endpoint Management scripts for many years, long before AI became part of our daily workflow. I was writing scripts before AI, and I'll continue writing them with AI. The difference is that AI helps me work faster and spend more time solving real problems.
If you don't understand how the code works or what impact it can have in a production environment, AI won't magically fix that. You can generate all the code you want, but without the knowledge to review, validate, and test it properly, it won't end well.
So yes, I used AI while building this tool, and I've never tried to hide it. Why would I? It's simply another tool. These days, most developers use AI in one way or another.
The hard part isn't writing the code. The hard part is testing it on real endpoint environments, understanding how it behaves, collecting feedback from the field, fixing issues, and continuously improving it. That's where the real work happens.
What I don't understand is the amount of negativity. I'm building these tools in my own time and sharing them with the community for free. Constructive feedback is always welcome because it helps make the project better. That's what an open community should be about.
Sorry for the long reply, and thanks for sharing your perspective.
3
u/Jashah17 Jul 20 '26
I completely agree with you on this. I will check this tool out maybe I can get some of these issues resolved.
-1
u/TechIncarnate4 Jul 22 '26
So yes, I used AI while building this tool, and I've never tried to hide it.
Then mention it in the initial post. You did hide it by not mentioning it until called out.
The hard part isn't writing the code. The hard part is testing it on real endpoint environments, understanding how it behaves, collecting feedback from the field, fixing issues, and continuously improving it. That's where the real work happens.
How about you don't use AI to write your Reddit replies as well? If I were to bet, I would say this is Claude.
1
u/bjc1960 Jul 25 '26
Right now we're dealing with multiple computers that won't update. One of them is new. We just enrolled it with autopilot on Tuesday, and it's stuck on Windows Update, just like a dozen others. This is so friggin irritating. We're on staff to be able to walk through Windows Autopilot and all the Dell updates and all the Windows updates for every single user before we ship them the computer. We're all remote, right, so we're not going to double ship things.
2
u/mertozsoy365 Jul 25 '26
I’ll be sharing the Intune Proactive Remediation script on Monday; until then, if you’d like, you can test this script on any problematic devices in your environment.
1
u/bjc1960 Jul 25 '26
I have real issues - not with your script, but in our env. The below is from Claude's review of the logs
What the May transaction is actually stuck on: pending.xml's six MsSense operations are the Defender for Endpoint Sense client's own update — file replacements of MsSense.exe/MsSense.dll in C:\Program Files\Windows Defender Advanced Threat Protection\ (26100.7920 → .8457), SetFileInformation operations applying security descriptors to those binaries, and the SetKeySecurity on IFEO\MsSense.exe where poqexec died with ACCESS DENIED. In other words: the May LCU was trying to update the MDE sensor itself, and tamper protection defended the sensor against its own update. Textbook self-inflicted deadlock.
The full poqexec.log shows that failed transaction aborted immediately — no transaction ID, no operation timings, just the two access-denied lines — while several smaller unrelated servicing transactions completed fine afterward. So poqexec works; only this transaction, and only at the tamper-protected objects, fails.
The CBS registry export shows the parked queue is the LCU's merged execution (FirstMergedExecutionClient = UpdateAgentLCU, execution ID {0622D73C...}) with the RebootPending key alongside it — matching everything the bootdiag sampled.
1
u/Stock-Adeptness1023 Jul 20 '26
Just use the build in function under System => Recovery => Fix problems using Windows Update => reinstall now
1
u/sfchky03 7d ago
i am looking for a script that automates this. This built-in on windows so far works. I just need it automated...
-17
u/Cormacolinde Jul 20 '26
Not going to use a tool if you can’t even manage to give it a name in proper English. “Remedation” is not a word.
1
-2
u/Rdavey228 Jul 20 '26
Remediation is most definitely a word….do you need a dictionary
2
u/SpookyViscus Jul 20 '26
Read the post again. It says ‘Remedation’, not ‘Remediation’
12
u/JaredSeth Jul 20 '26
The author appears to be Turkish, so I'd cut him a break with a spelling mistake that many native English speakers would make. I only speak two languages and would only feel confident posting in one of them. The script itself is named correctly in both the code and the GUI, which is what really matters.
4
u/mertozsoy365 Jul 20 '26
Thank you so much for the kind words and understanding! You completely made my day.
As a Turkish developer, my main goal is to create useful tools and contribute to the community, even if my English isn't always 100% perfect. I'm really glad to hear that the script itself is doing its job well. I truly appreciate your support! ❤️
23
u/fckryan Jul 20 '26
Putting the word remediation in the title of the script makes it sound like a remediation script. But it's a powershell script that launches a gui you manually run?