Force Windows Update on Intune Devices

A common and frustrating challenge for Intune administrators: your policies are set, but devices remain out-of-date because the local Windows Update Service is stuck or corrupted. These Intune devices not updating pose a significant security risk, forcing IT staff into manual troubleshooting.

The solution is to lean on Intune Remediations (formerly Proactive Remediations) to automatically detect, reset and force the update process without manual intervention. In this guide we walk through a robust detection and remediation script package designed to target devices pending a reboot or stuck in a non-compliant state.

What the script package does

The solution uses a pair of PowerShell scripts — a Detection script and a Remediation script — deployed via Intune Remediations. The goal is to enforce security updates and complete necessary reboots on non-compliant devices.

• Detect.ps1 checks multiple indicators of an incomplete update or pending reboot. If any key is found (Windows Update RebootRequired, Component Based Servicing RebootPending, or PendingFileRenameOperations), it returns Exit Code 1 (non-compliant) and triggers the remediation.
• Remediation.ps1 only runs if the device is detected as non-compliant. It ensures the Windows Update Service (wuauserv) is running, then uses usoclient ScanInstallWait to combine scan, download and install in a single operation. Finally it schedules a graceful 30-minute reboot with a user notification if one is needed.

Detection logic — three registry checks

Exit Code 1 means non-compliant and triggers remediation. Exit Code 0 means compliant. The script checks three locations so we catch pending actions from various installers, not just Windows Update:

1. HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired — the general flag set by Windows Update.
2. HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending — reboot tied to the servicing stack or a cumulative update.
3. HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations — files queued for replacement by Office, third-party software or Windows components. The most robust check.

If any of these three return true, the script exits with code 1 and the remediation runs.

Remediation: the safety features that matter

The remediation script is engineered with three primary jobs: logging, forcing the update and ensuring a graceful reboot.

• Robust logging to a local log file, the Windows Application Event Log (custom source Intune-ProactiveRemediation-WU) and the PowerShell host — which is reported back to the Intune console for troubleshooting.
• Forcing the update process by confirming wuauserv is running, then calling usoclient ScanInstallWait. This is the modern, recommended way to trigger the Update Orchestrator Service to perform a combined scan, download and install cycle.
• Post-install wait loop of up to 10 minutes that keeps checking whether the RebootRequired key has been removed, so we confirm the installation has truly finished before deciding whether to reboot.
• Graceful reboot with user notification. If the reboot key is still present after the wait loop, the script sends a msg * console message immediately and then schedules shutdown /r /t 1800 — a 30-minute countdown so the user can save their work.
• Compliance flag written to HKLM:\Software\Company\Compliance\UpdateRemediated so you can use a dynamic device group later to confirm when a device was last remediated.

Prerequisites

Before deploying the script package, make sure your tenant meets the licensing requirements for Remediations and create your target device group.

• Licensing attestation. Remediations requires Windows Enterprise (E3 or E5) for end-users on target devices. In the Intune admin centre, go to Tenant administration > Connectors and tokens > Windows data and toggle Windows license verification to On.
• Target device group. Create a security group (Assigned for a proof of concept, Dynamic Device for production) — for example Out of Date Windows 11 devices.
• Two scripts ready to upload — Detect.ps1 and Remediation.ps1.

Deploying in Intune

1. Navigate to Devices > Scripts and remediations > Remediations > Create.
2. On the Basics tab, name the package (for example Force Windows Updates) and add a publisher.
3. On the Settings tab, upload Detect.ps1 as the detection script and Remediation.ps1 as the remediation script. Configure:
   • Run this script using the logged-on credentials: No (scripts must run as System to manage services and HKLM).
   • Enforce script signature check: No (unless your scripts are signed).
   • Run script in 64-bit PowerShell: Yes.
4. Assign the package to your target group and set a Daily schedule for compliance fixes.
5. Review and create.

Monitoring and refinement

Once deployed, monitor the package under Devices > Scripts and remediations. The overview dashboard shows detection vs. remediation success across the fleet.

For further efficiency, refine the targeting group with a dynamic rule that leverages the UpdateRemediated flag set by the remediation script — so you target only devices that have not been successfully remediated in the last 30 or 60 days, focusing the script's effort where it's truly needed.

If you'd like help rolling this out across a managed estate, or pairing it with broader endpoint hardening, get in touch — it's the kind of work our Modern Endpoint Management practice does day in, day out.