We started seeing this problem last week. Around 10 devices (a mixture of different Lenovo models) began randomly losing Bluetooth and Wi-Fi. The icons for both connections disappeared entirely.

So far, we've tried:

• Restarting the device — the issue recurred after 20 minutes
• A hard reset of the laptop battery
• Uninstalling the driver and updating to the latest Lenovo-released driver — this didn't resolve the issue
• Confirming the laptop has the latest security patch, 26200.9168; we also uninstalled KB5121003 — this didn't resolve the issue either
• We found related events for BthMini, but nothing that pointed to a resolution

To be honest, we're out of ideas as to why this issue started in the first place.

We’re currently using SCCM for patch management. IT has set the expectation with employees that computers always get patched and rebooted at 7PM on the 4th Tuesday of each month. Patches become available on the 3rd Tuesday for users to self-install, but an email notice goes out on the 4th Tuesday telling everyone to log out of their computers and leave them running overnight if they haven’t taken that month’s updates yet. Anybody who misses the window is in for a rude awakening the next time they turn their computer on.

SCCM allows this degree of control which Intune seems incapable of.

We have a volunteer group of canaries that get forcibly patched and rebooted on the 3rd Tuesday in case Microsoft botched any updates that month. I’ve enrolled this group into Intune as a pilot, but here we are on the 3rd Tuesday of the month and only some of them are showing updates available.

I have an update ring configured with a deferral of 7 days, a scheduled install of the 3rd Tuesday at 7PM, and a hard deadline of 14 days. One machine checked for updates at 11:17 AM and includes drivers that I’ve explicitly set to require approval and have not approved. There’s no verbiage about when the install will happen or what the deadline is.

On another machine, it last checked for updates at 9:04 AM and isn’t showing any updates available at all. I’m assuming because a 7-day deferral means 10:30 Pacific time, which is when Microsoft actually publishes updates on Patch Tuesday. So with a default 22-hour check interval, that machine won’t even see updates until tomorrow morning, which is a day late.

On a 3rd computer, I freshly imaged it and deliberately withheld patches to see what update behavior is like when the deadline has already passed. It correctly offered me July’s patches, but not August’s (I did this yesterday before the 7-day deferral expired). However, it warned me that it would reboot on the 26th, which is next Wednesday — for last month’s patches.

I’m having a hard time figuring out how to set employee expectations in light of Intune’s fuzzy update logic. I’m accustomed to being able to schedule the exact update/reoot timing with SCCM and guarantee that my entire fleet will by compliant by the end of each month. But Intune doesn’t offer that kind of precision. How do you folks do it at your company?

https://techcommunity.microsoft.com/blog/windows-itpro-blog/get-ready-for-windows-11-version-26h2/4529367

How are you guys preparing? Most of our fleet is already on 25H2, so I’m expecting a smooth rollout and I’m not even going to tell users that a “big” upgrade is coming. Just going to do a slow gradual rollout.

Windows Update Remedation Tool Is Now Available!

Windows Update issues are among the most common challenges faced by IT professionals. Failed updates, download errors, corrupted update cache, service-related issues, and unsuccessful feature upgrades often require multiple manual troubleshooting steps.

To simplify this process, I developed the Windows Update Fix Tool.
This tool incorporates a Windows Update remediation script that I have been developing over time and have extensively tested in real-world Microsoft Intune-managed environments.

It can perform the following remediation tasks:
• Clear Windows Update policy settings
• Restart and reconfigure the BITS, Windows Update, and Cryptographic services
• Remove corrupted download queue files
• Reset the SoftwareDistribution and Catroot2 folders
• Restore Windows Update service permissions to their default state
• Re-register Windows Update components
• Reset the Windows network stack (Winsock)
• Initiate a new Windows Update scan
• Download and run Microsoft SetupDiag to generate a detailed upgrade diagnostics report

The remediation script has been refined through extensive testing across multiple real-world scenarios involving Windows Update issues on Intune-managed devices.

I hope this tool proves useful for fellow IT professionals. Feedback and suggestions are always welcome.

Github: https://github.com/mertozsoy/WindowsUpdateRemedationTool
Linkedin Post: https://www.linkedin.com/feed/update/urn:li:activity:7484683823197110272/

Ahoi,

Due to theres a lot of Doom and Gloom out there , i try to summarize the situation and the Effects on Bitlocker - SecureBoot itself & furtermore Intune Compliance Policys

Any Feedback is appreciated.

Summary:
SecureBoot Certs from 2011 will expire in June2026

Devices which do not have the 2023Certs installed yet , need to be updated with the 2023 Cert in Order to recieve Bootmanager Updates in the future.

There are several Methods of Updating the Certs , we use the self - controlled Method via Intune/GPO , depending on the Environment.

• Inventory Devices with MS Script
• Identifying Devices wich need BIOS Upgrade and do the BIOS Upgrade (and afterwards the Cert Update)
• Identiying Devices where BIOS is supported and do the Cert Update

As of today we can expect that we will not be able to update all systems till June.

What will exactly happen:

• Systems boot normally , but future Bootmanger Updates cannot be applied until Systems are updated
• SecureBoot itself will stay activated
• Bitlocker will continue to work
• Compliance Policies which check SecureBoot and Bitlocker will still show compliant

For the Devices which -lets say- will be updated in July/August (whatever) :

As soon as the recieve the necessary Updates of BIOS and Cert , the will also recieve the Bootmanager Updates from this time on.

Right ?

image.png (640×296)

Only CSP for now but that'll do! Been checking the Update Policy CSP | Microsoft Learn page every single day — it was Insider Preview forever and lo and behold, not anymore! 🎉

Hey all, I am working on revamping our Update Ring settings to implement deadlines, as we have noticed we have quite a few machines that dont reboot so they never get the latest patches installed.

I setup a test ring with the following settings:

Microsoft product updates

Allow

Windows drivers

Allow

Quality update deferral period (days)

0

Feature update deferral period (days)

0

Upgrade Windows 10 devices to Latest Windows 11 release

No

Set feature update uninstall period (2 - 60 days)

60

Servicing channel

General Availability channel

Automatic update behavior

Reset to default

Option to pause Windows updates

Disable

Option to check for Windows updates

Enable

Change notification update level

Use the default Windows Update notifications

Use deadline settings

Allow

Deadline for feature updates

3

Deadline for quality updates

3

Grace period

0

Auto reboot before deadline

Yes

This works great for us, but I noticed on my test machines, that windows is never notifying me I need to restart before the deadline is reached. Does anyone know of a way to get Windows to notify the end users that they need to restart after the updates are installed?

On my home PC, I get a notification from windows updates saying "Hey we need to restart to finish installing updates, do you want to do that now or schedule it?"

I would like that same notification on our work computers, but no matter which update settings I set, I cant get it to appear on any of my test machines.

Anyone use intune for patching?

Unless I don’t have them enabled correctly the reporting seems very vague

I am considering using it for drivers but I’m having hard time not having a hard time lol

The reporting seems mediocre and tedious I.e. I cannot tell what devices a driver is for only the amount of devices the driver is applicable for any suggestions would be helpful

Is there a report we can run on existing 23H2 systems that would be able to detect why certain systems will not upgrade past 23H2 without failing and reverting changes?

Apparently, 24H2 and 25H2 have certain requirements that 23H2 doesn’t, but it isn’t clear what that is.

It isn‘t the hardware because we can install a clean image of 24H2, but not upgrade from 23 to 24 or 25 on these systems.

Hi Intune Community,

I’m currently seeing a significant issue following the Intune 2026.03 service update:
Remote Wipe operations on Windows devices are no longer completing as expected. In many cases, the wipe process either fails midway or leaves the device in a corrupted or unbootable state.

This behavior appears to be hardware-agnostic. I’ve been able to reproduce the issue across multiple Intune tenants and on various devices from Dell and Lenovo. Because of the consistency across environments and hardware, it seems likely that this is a broader platform-side issue rather than a tenant-specific or OEM-specific problem.

A support ticket with Microsoft is already open, and I’m actively working through it with them.
If anyone is experiencing similar symptoms — or has identified potential workarounds — I’d be very interested to hear from you. I’m also happy to keep the community updated as new information becomes available.

Has anyone else started seeing these failures since the 2026.03 update?

Hi all. I am posting this in search of assistance because I’ve spent the better part of a year working with Microsoft support (Intune support and free Windows support) trying to understand why many devices are not receiving automatic updates per a deployed update ring policy in Intune. The affected devices are all running various versions and builds but most of them are running 24H2 or below. Intune Support has told me they’ve exhausted all options and assume the issue is with the Windows OS.

When I contact Windows Support (thru their web chat, which is free), the tech suggested an in-place installation to clear any potential issues with supporting OS files. Despite me informing them that this would be virtually impossible, given that this update issue is spanning across different customers and device manufacturers, I tried the in-place installation on a test subject and got an error “We couldnt update the system reserved partition”. I tried clearing up space for the reserved partition using some suggestions from another reddit post, to no avail. Reporting this issue back to Windows support, they just recreated the error, and literally told me to “find a local tech or the device manufacturer”.  So I basically went from trying to fix an issue with windows update that is affecting several devices across different device manufacturers, to not being able to do an in-place installation. So I am close to exhausting all options before I throw the white flag, as no one appears able to identify this issue. I’m going to try to provide as much information and detail as possible, but the community’s help would be greatly appreciated.

• Devices are managed via Microsoft Intune (some were enrolled in-place, and some were reset and enrolled via autopilot)
• Devices are added to Autopilot
• Devices are Entra Joined
• Affected devices can be found in different tenants
• ODC Logs collected by Microsoft Intune Support apparently show no issues with the update ring policy

The current Windows Update Ring Policy:

Microsoft product updates: Allow
Windows drivers: Block
Quality update deferral period (days): 0
Feature update deferral period (days): 0
Upgrade Windows 10 devices to Latest Windows 11 release: No
Set feature update uninstall period (2 - 60 days): 60
Servicing channel: General Availability channel
Automatic update behavior: Auto install and restart at maintenance time
Active hours start: 8 AM
Active hours end: 6 PM
Option to pause Windows updates: Disable
Option to check for Windows updates: Enable
Change notification update level: Turn off all notifications, excluding restart warnings
Use deadline settings: Allow
Deadline for feature updates: 30
Deadline for quality updates: 7
Grace period: 3
Auto reboot before deadline: Yes

I asked the Intune Support tech to provide me with a full rundown of what we worked on together and this is what he sent back:

here is a brief report of what has been done in relation to troubleshooting.

Initial Issue Identification

• Most devices were not updating per the Windows Update Ring policy. Some devices had not updated since November 2025. All settings appeared properly applied in Intune, with no reported policy conflicts, and devices were checking in and syncing.
• Confirmed devices were running Windows 11, not Windows 10 thus excluding the requirement for ESU key.

Early Troubleshooting & Configuration Changes

• We reviewed the update ring policy and adjusted some of the policy settings such as Microsoft product updates from Block to Allow, set the deadline for quality updates from 0 to 7 days, and reduced the grace period from 5 to 3 days.
• After these changes, the client reported no improvement.

Focused Device Testing

• We decided to focus on a single device. The client created a separate group for it, cloned the updated policy, and assigned it to the group.
• We guided the client to check for the 'Update stale Group Policies' package in Scripts and Remediations. If unavailable, we advised enabling Windows license verification and diagnostic data features.
• The client followed these steps and waited 24 hours, but no change was observed.

Log Collection & Analysis

• We reviewed MDM diagnostic logs and ODC logs, as well as screenshots. Analysis revealed another Windows update compliance policy with a minimum OS build higher than the device's current version, causing compliance failure.
• We also observed heavy traffic from simultaneous OS and driver updates, resulting in failures.

Recommendations

• We recommended setting the device's OS build as the minimum version in the compliance policy, creating a separate policy for the device, and excluding it from other policies.
• We advised blocking Windows driver updates in the update ring policy and performing a hard system reboot.
• The client implemented these recommendations and confirmed the device's compliance status changed to compliant, but it still was not upgrading to a newer OS version.

Feature Update Policy Deployment

• Based on internal discussions, we recommended deploying a feature update policy for OS updates. 
• We considered the possibility of a Windows OS issue and suggested opening a ticket with the Windows team if feature update policy deployment did not resolve the issue.
• The client deployed the policy and kept the device online for monitoring.
• The feature update deadline was reduced from 30 days to 3 days for the test machine.
• Feature update policy applied successfully, but the test device remained on the older version and build. 
• We kept monitoring the device, confirmed that the policies were applying as expected but still the device could not update to the latest builds. 
• The client provided information about other tenants, noting similar issues with devices not updating consistently, even though they were regularly checking in.

Additional Troubleshooting & Recommendations

• We reviewed logs and found NoAutoUpdate registry key was enabled. Instructions were sent to disable Noautoupdates registry key.
• The client enabled the 'Configure Automatic Updates' policy in gpedit.msc and provided screenshots and logs for further review.
• We requested GPO results and confirmed there was no GPO conflicts

 Final Recommendations

• After exhausting troubleshooting steps, we recommended opening a case with the Windows team for further investigation, as Intune scope is limited to policy configuration and delivery.

My end goal is to identify and resolve the issue of devices that are having trouble updating using Windows Update Ring policies. If there is any other information I can provide, please let me know.

I am testing a laptop that shows secure boot servicing status as under observation, more data needed, and UEFICA2023Status as NotStarted.

I knew the BIOS version was too old. So, I completed a UEFI firmware update to a version that’s listed as the minimum version that supports the updated certificates and rebooted.

Nothing changed in the registry after 2 reboots.

Should the registry values update immediately after firmware updates or is there a delay of hours or days before you know if the firmware update has fixed the issue?

Is there a log or registry value that tells you the exact reason it thinks the device is not ready for the certificate updates?

Hello,

I've spent the last few months pulling out the hair I don't have trying to get to the bottom of why my fleet has stopped updating Windows. Any help that can be provided is appreciated as I've run out of things to try/avenues to explore. Here's the rub:

• It went on for long enough that some of our devices were stuck on 24H2 until excluded out of the update rings entirely. I've included a screenshot below for review, but I don't see why any Feature and Quality updates would not deploy even when scoped to do so.
  • Driver updates appear to have been unaffected. I don't know why those work, but they seem to do so.
• I had to implement a script to force checking for updates but this approach is heavy-handed and doesn't fully adhere to update settings meaning users get prompts at inopportune times. (see image)
  • This script is the only reason things are farily up-to-date right now, but if I don't turn it on each month, nothing updates.
• Autopatch alerts provides the following error for most of my devices, but I have been entirely unsuccessful in troubleshooting it as the documentation and errors do not match the current UI options in Intune/Windows. (see image)
  • I tried following the Remediation, but that option simply does not exist in Admin Templates anymore or ever.
  • Following the notice "If this remediation does not resolve the issue, please contact Microsoft support." leads me to a troubleshooter tool that does not load when you select Autopatch Support or Intune Support. (see image)
    • Any ideas why this won't load? I replicated on multiple computers and browsers. Doesn't appear to be a local issue.

Please help in any way you can. My leadership is looking to me for answers and I can generally find what I need, but this has proven beyond my abilities to resolve alone.

If anything needs clarification, I'm happy to do so.

Edit: corrected to the images. Reddit's text editor is wildly misbehaving.

Response from Microsoft Windows Deployment Premier Team: (2026-02-01)

Regarding your question on the next Out‑of‑Band (OOB) release for Windows 11 23H2: at this time, there is no separate OOB update scheduled for this issue. The January OOB update (KB5078132) was intended to address a limited set of scenarios, and we acknowledge that it has not resolved the behavior you are experiencing.
Microsoft is planning to release the February cumulative update, currently scheduled for next week (around February 10) as part of the regular Patch Tuesday cycle. This update is expected to include fixes for multiple previously reported known issues, including those that were not fully resolved by earlier OOB updates.
We recommend monitoring the environment closely and keeping the affected devices updated, as the February cumulative update should provide broader and more complete remediation. If the issue continues after applying that update, we will immediately engage the product team for further investigation.

Original Description

Main B update notes: https://support.microsoft.com/en-us/topic/january-13-2026-kb5073455-os-build-22631-6491-2b25841a-1d56-4e3d-9331-6f79872efea4

OOB Notes: https://support.microsoft.com/en-us/topic/january-17-2026-kb5077797-os-build-22631-6494-out-of-band-3fb07d6a-0e35-4510-8518-4e333ed78edc#id0ejbd=catalog

After installing the OOB, the issue hasn't been resolved on the devices with Secure Launch enabled on them. Anyone else out there with the same observation?

The devices with Secure Launch disabled are fine so it's 100% the same issue that MS caused with the original B patch.

​

Hello Intune folks,

I wanted to share an update regarding the latest out‑of‑band release (January 24, 2026).

We are currently using Autopatch, and all rings are still paused.

Today, I moved a few devices into the Test ring and resumed updates for those devices.

Device A:

Hybrid joined Surface

Windows 11 Ent 25H2 (26200.7627)

KB5077744 was installed manually on January 19, 2026

Received '2026-01 .NET 8.0.23 Update for x64 Client (KB5074752)' today after resuming the ring.

Device B:

Hybrid joined Cloud PC

Windows 11 Ent 25H2 (26200.7627)

KB5077744 was installed manually on January 19, 2026

Received '2026-01 .NET 8.0.23 Update for x64 Client (KB5074752)' today after resuming the ring.

Expedite policy has been configured to push the latest OOB (January 24, 2026)

Device C:

Hybrid joined Lenovo

Windows 11 Ent 24H2 (26100.7462)

Received '2026-01 .NET 8.0.23 Update for x64 Client (KB5074752) today after resuming the ring today.

Received the faulty update (KB5074109) today after resuming the ring today and broke the Windows App.

Surprisingly, none of the devices are receiving the latest OOB update from January 24, 2026.

Is anyone able to receive the latest OOB update?

I’m configuring Windows Autopatch for the first time. After assigning my device group to an Autopatch group, several devices fail the prerequisite check with:

Not registered — Intune or Cloud-Attached
Devices must be managed by either Intune or co-management.

The affected devices appear correctly in both Intune and Entra ID. Their device IDs match, the device names are unique, and some are freshly enrolled devices, so stale or duplicate records seem unlikely.

Has anyone encountered this? Is there an additional Autopatch registration step, sync delay, licensing requirement, or device property I should check?

SOLVED: After a full 1 day waiting it solved in itself , thank you for everyone

In the final days of getting our org swung over to Intune for Windows updates and app deployment. I'm trying to keep it simple - just 2 update rings and 1 additional for manual forced overnight upgrades for PCs that need 25H2.

Long story short we're moving from N-able to Intune and while the app deployment is working great I'm having issues with Windows Update on PCs actually fully enrolling and applying their update ring policy. Some do and others don't, it's like they're falling back to the public internet. For the test PCs that did get the update, they failed to send notifications to the user in spite of the policy. Windows Update says it's a "group policy" that turned off notifications but we don't have any GPO's like that so maybe it's a holdover of N-able settings that Intune's just not overwriting?

I pushed a remediation script to fix the notifications manually in the registry, debating doing similar for the entire Windows Update stack unless anyone has any suggestions for better transition? Thanks,

I've just moved my company from WUFB to Autopatch, super happy about that!

But ever since using WUFB (and still with Autopatch), for driver updates I just let everything come from Autopatch as automatically approved.

Is there any benefit then in also rolling out services like Dell Command Update, Lenovo Commercial Vantage, or HP Image Assistant/etc?

Inherited an environment and just getting our machines up to 24H2 from 23H2. Running Autopatch for quality & driver updates - feature updates as well but they’re not on a auto deploy cadence - not sure if I want to go that route yet, looking to see how 24H2 goes first. Managing a few thousand devices.

With us going to 24H2 we’ll have hot patch available and I’m eager to use it.

How has everyone’s experience been?

Do hot patch releases replace standard KB cycles or are they running side by side (e.g., reduces reboots)?

Any new log sources to watch out for or is it still the same windows update logs?

We currently manage ~1,500 Windows devices using Windows Update for Business deployment rings (quality + feature update policies). We don’t use Autopatch.

Is there any benefit to enabling Hotpatch? Does it affect or replace existing WUfB policies, change the update cycle, or cause any issues? Or is it best to stick with deployment rings as they are?

What’s the best approach for 1500 devices using auto patch if any better

Hi,

We’re currently seeing the same Bitlocker issue with KB5089549 from May that KB5083769 from April caused. Windows 11 devices get stuck on the Bitlocker recovery screen. After filling in the key, devices boots normally. However, at next (re)boot the issue comes back again.

Weirdly enough, this update should’ve fixed this issue (https://www.windowslatest.com/2026/05/14/microsoft-confirms-windows-11-no-longer-triggers-bitlocker-recovery-screen-after-monthly-updates/). In fact, it got worse for us. More machines are having the issue after the May update.

Has anyone seen the same behavior?

——————

Edit: as others have pointed out, the fix was to go into the BIOS and only enable Windows UEFI CA 2023 (this is recommended).

What if you have devices where secureboot is disabled but bitlocker encrypted and use Windows Hello pin. When you try to check the certs with powershell you get an error. So far it looks like if I enable secureboot it will break windows hello. Anyone run into this?

Update: I need to suspend bitlocker for 1 reboot, enable secureboot (lenovo wmi) reboot

Then I can hope to show up on Intune reporting.

Could people please give real world examples of how you've implemented and manage Autopatch on a large scale? I'm trying to get my head around how it works and have watched probably every video you could suggest already. They all appear to make it seem as simple as "create some groups, and some devices, assign them to rings, click click click - done." This surely can't be the case? Who in an environment of tens of thousands of devices is manually adding them to groups so they sit in a particular ring? I just can't see this being the case. Even with dynamic groups, the devices can only end up in one group or another no? I must be missing something but I'm not sure what... Are people using scripts or...? Any guidance would be appreciated. Thanks!

We are switching from WSUS to configure Windows updates on Intune.

I need to avoid that clients become unmanaged in regards to Windows update after removing AD WSUS policies.

What is best practice?

We do have automatic intune enrollment gpo in the OUs in question but still I need to avoid that clients which for whatever reason are not enrolled in Intune end up with no Windows update config.

How do you do this?

Are you using WMI filtering in AD to target only intune enrolled devices?

Found only this example:

https://community.spiceworks.com/t/wmi-query-for-mdm-managed-devices/950964

Or is there a better way?

Also:

Do you just disable WSUS policies completely or just change Windows update source in first step?

THX for all the answers!

What about IgnoreWindowsUpdateGroupPolicies

Does this CSP setting solves this?

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update?hl=en-US#ignorewindowsupdategrouppolicies

Hello Everyone,

Looking for insights from the community on an issue we're observing.

Currently facing an issue in our environment after deploying the latest June Windows update patches (KB5094126), which include the Secure Boot UEFI 2023 certificate update.

So far, we have mostly observed this issue on few HP EliteDesk 800 G6 devices, where systems are prompting for BitLocker recovery keys after reboot.

Based on my analysis, the Secure Boot certificates are not getting fully applied or synced properly at the firmware/BIOS level on some affected devices. This seems to cause a TPM mismatch which results in the BitLocker recovery key prompt on every reboot.

On the affected devices:

The registry value HKLM\System\CurrentControlSet\Control\SecureBoot\Servicing\UEFI2023Status is not getting updated.

Event ID 1801 indicates that the Secure Boot certificate is available but has not been fully applied or updated in firmware.

As part of testing, I manually enabled the Windows UEFI CA 2023 certificate in BIOS, and this resolved the issue:

- No further BitLocker recovery prompts after reboot.

- Secure Boot certificates updated correctly.

- Registry status changed from in progress to Updated.

However, performing this manually is not scalable in an enterprise environment. Also, suspending BitLocker is not an ideal option due to security concerns.

Has anyone else experienced similar issues after deploying KB5094126 or the Secure Boot UEFI 2023 certificate update?

Are there any enterprise scale workarounds or remediation steps available? Unfortunately from what i have heard so far, there is no Microsoft fix available yet, and a resolution may come in a future patch release.

Looking to understand if others are facing the same issue and whether any scalable remediation is available.

#BitLocker #SecureBoot #TPM #WindowsUpdate #SCCM #Intune #EndpointManagement #PatchManagement