June 2025 Workaround (FINALLY!) – Update stack remains stuck in a local scan state and doesn’t ask for deployments in WUFB related to Feature Updates<\/strong><\/p>\n\n\n\n Issue: <\/strong>Microsoft support has informed me, that in sporadic occurrences, there is a bug, where the Update stack remains stuck in a local scan state and doesn’t ask for deployments in WUFB related to Feature Updates.<\/p>\n\n\n\n Problem: <\/strong> Some devices that are running Windows 10 or Windows 11, version 19H1 and above,\u00a0aren’t able to install monthly security updates because of file or metadata\u00a0corruption within the servicing stack. These devices may not be able to become up to date without a Feature Update.\u00a0<\/p>\n\n\n\n Solution\/Workaround: <\/strong>Microsoft is working on an fix, which will be included in Autopatch at some point this year, but until then we can fix it manually by added the below mentioned command on the client.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n In a rather cryptic way, this is also covered in this Microsoft article<\/a>, even though the above reg-keys and values are not mentioned. <\/p>\n\n\n\n This blog contains the scripts I used to solve this – both related to backend-issues like device is stuck in ‘Offering’ state – and also endpoint-related issues.<\/p>\n\n\n\n Microsoft has also released a troubleshooting guide, which you can find here<\/a><\/p>\n\n\n\n I’m using the Microsoft Graph API endpoint mentioned in the Microsoft guide (“https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets”). You can see link in each section below to the Graph documentation. Click here<\/a> to access the documentation.<\/p>\n\n\n\n As always, be patience when you make backend changes (I have seen from a few hours to up to 72 hours).<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n I have done a support-case with Microsoft support, where they have concluded that in sporadic occurrences, there is a backend bug, where the Update stack remains stuck in a local scan state and doesn’t ask for deployments in WUFB related to Feature Updates. <\/p>\n\n\n\n Cause for this issue is, when devices are un-enrolling and enrolling in WUfB and the Managed Update Session Orchestrator (MUSE) in some scenarios doesn’t handle this as intended.<\/p>\n\n\n\n Microsoft is working on an fix, which will be included in Autopatch at some point this year, but until then we can fix it manually by added the below mentioned command on the client. <\/p>\n\n\n\n I waited 48 hours and then Windows Feature Packs was offered on the impacted devices.<\/p>\n\n\n\n Note: <\/p>\n\n\n\n <\/p>\n\n\n\n All scripts are shown below, but you can also get them from my Github.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n This script can be used on the Windows endpoint. You must adjust the variables to your needs<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" I have been banging my head why some machines wouldn’t deploy Windows 11 Windows Feature Updates (24H2) as part of … <\/p>\n(Win11 23H2\/24H2 only)\nreg.exe Add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion \/v AllowInplaceUpgrade \/t REG_DWORD \/f \/d 4\n\n(Win10 22H2\/Win11 22H2 only)\nReg.exe Add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion \/v UpgradeEligible \/t REG_DWORD \/f \/d 1\n\nNote: \n* This registry value will be removed once the in-place upgrade is complete. \n* It can take up to 48 hours for the in-place upgrade to be offered to the device.\n* After the in-place upgrade, the device will be able to take new updates normally\n* Don't confuse with the same regkey AllowInplaceUpgrade which normally resides in HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate. For this parameter to work with value = 4, it must be set in HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/05\/image-24.png\")
<\/figure>\n\n\n\n<\/ul>\n<\/blockquote>\n\n\n\n
![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/05\/enrollment.jpg\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/05\/image-3-1024x103.png\")
<\/figure>\n\n\n\nIntune\/AutoPatch\/WUfB troubleshooting<\/h2>\n\n\n\n
\n
Windows Client troubleshooting<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/05\/image-5-1024x565.png\")
<\/figure>\n\n\n\nWorkaround for Stuck Update Stack<\/h2>\n\n\n\n
reg.exe Add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion \/v AllowInplaceUpgrade \/t REG_DWORD \/f \/d 4<\/code><\/pre>\n\n\n\n\n
\n
Scripts (Github)<\/h2>\n\n\n\n
\n
Intune: Get overview of enrollment status in AutoPatch\/WUfB<\/h2>\n\n\n\n
# Get Status about Windows Client devices from WUfB AutoPatch\n\nfunction Get-WUfBEnrollmentStatus {\n <#\n .SYNOPSIS\n Retrieves the WUfB AutoPatch enrollment status for Windows client devices managed by Intune (MDM).\n \n .PARAMETER ShowStatus\n Optional. If specified, displays output during processing using Write-Host.\n\n .OUTPUTS\n [PSCustomObject] array with DeviceName, DeviceId, EnrollmentStateFeature, EnrollmentStateQuality, EnrollmentStateDriver\n #>\n\n param (\n [switch]$ShowStatus = $false\n )\n\n $StatusEnrollmentWUfB = @()\n\n if ($ShowStatus) {\n Write-Host \"\"\n Write-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n }\n\n $devices = @()\n $uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\n do {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n } while ($uri)\n\n $ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"\n }\n\n if ($ShowStatus) {\n Write-Host \"\"\n Write-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n }\n\n foreach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n if ($ShowStatus) {\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n }\n\n $enrollmentStateFeature = $null\n $enrollmentStateQuality = $null\n $enrollmentStateDriver = $null\n $errorsWUfB = 0\n\n try {\n $wuAsset = Invoke-MgGraphRequest -Method GET -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/$deviceId\"\n $enrollmentStateFeature = $wuAsset.enrollment.feature.enrollmentState\n $enrollmentStateQuality = $wuAsset.enrollment.quality.enrollmentState\n $enrollmentStateDriver = $wuAsset.enrollment.driver.enrollmentState\n $errorsWUfB = if ($wuAsset.errors) { $wuAsset.errors.Count } else { 0 }\n\n if ($ShowStatus) {\n Write-Host \"\ud83d\udccb Enrollment State Feature: $enrollmentStateFeature\"\n Write-Host \"\ud83d\udccb Enrollment State Quality: $enrollmentStateQuality\"\n Write-Host \"\ud83d\udccb Enrollment State Driver : $enrollmentStateDriver\"\n Write-Host \"\ud83d\udccb Errors (WUfB) : $errorsWUfB\"\n }\n\n $StatusObj = [PSCustomObject]@{\n DeviceName = $deviceName\n DeviceId = $deviceId\n EnrollmentStateFeature = $enrollmentStateFeature\n EnrollmentStateQuality = $enrollmentStateQuality\n EnrollmentStateDriver = $enrollmentStateDriver\n ErrorsWUfB = $errorsWUfB\n }\n\n $StatusEnrollmentWUfB += $StatusObj\n }\n catch {\n if ($_.Exception.Response.StatusCode.value__ -eq 404) {\n if ($ShowOut) {\n Write-Host \"\u2139\ufe0f Device not found in WUfB AutoPatch\"\n }\n } else {\n if ($ShowStatus) {\n Write-Host \"\u274c Failed to process $deviceName ($deviceId): $($_.Exception.Message)\"\n }\n }\n continue\n }\n }\n\n return $StatusEnrollmentWUfB\n}\n\n# Call the function and save results\n$WUStatus = Get-WUfBEnrollmentStatus -ShowStatus\n\n# Optionally view as a table\n$WUStatus | Sort-Object EnrollmentStateFeature, EnrollmentStateQuality, EnrollmentStateDriver -Descending | Format-Table -AutoSize<\/strong><\/code><\/pre>\n\n\n\n# Call the function and save results\n$WUStatus = Get-WUfBEnrollmentStatus -ShowStatus\n\n# Optionally view as a table\n$WUStatus | Sort-Object EnrollmentStateFeature, EnrollmentStateQuality, EnrollmentStateDriver -Descending | Format-Table -AutoSize<\/code><\/pre>\n\n\n\nAuthentication (Microsoft Graph)<\/h2>\n\n\n\n
# First, ensure you're connected to Graph with the right scopes:\nConnect-MgGraph -Scopes \"DeviceManagementManagedDevices.ReadWrite.All\", \"WindowsUpdates.ReadWrite.All\"<\/code><\/pre>\n\n\n\nIntune: Force Un-enroll Windows Client devices from WUfB AutoPatch, where state is NOT ‘Enrolled’ (Feature Updates only)<\/h2>\n\n\n\n
# Force Un-enroll Windows Client devices from WUfB AutoPatch, where state is NOT 'Enrolled' (Feature Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-unenrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\nwrite-host \"Get enrollment status for devices ... Pleae Wait !\"\n$StatusEnrollmentWUfB = Get-WUfBEnrollmentStatus\n\n# Build a lookup dictionary from enrollment status for fast access\n$StatusLookup = @{}\nforeach ($entry in $StatusEnrollmentWUfB) {\n $StatusLookup[$entry.DeviceId] = $entry\n}\n\n# Filter: MDM-managed Windows devices that are NOT enrolled for 'feature' updates\n$ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and\n $_.operatingSystem -like \"Windows*\" -and\n $StatusLookup.ContainsKey($_.azureADDeviceId) -and\n $StatusLookup[$_.azureADDeviceId].EnrollmentStateFeature -ne \"enrolled\"\n}\n\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n # Build JSON body for (un)enrollment\n $body = @{\n updateCategory = \"feature\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/unenrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Force Delete All Windows Client devices from WUfB AutoPatch, where Feature Update enrollment state is stuck in ‘enrolling’ or ‘unenrolling’<\/h2>\n\n\n\n
# Force Delete All Windows Client devices from WUfB AutoPatch, where Feature Update enrollment state is stuck in 'enrolling' or 'unenrolling'\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-delete?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\nwrite-host \"Get enrollment status for devices ... Please Wait !\"\n$StatusEnrollmentWUfB = Get-WUfBEnrollmentStatus\n\n# Build a lookup dictionary from enrollment status for fast access\n$StatusLookup = @{}\nforeach ($entry in $StatusEnrollmentWUfB) {\n $StatusLookup[$entry.DeviceId] = $entry\n}\n\n# Filter: MDM-managed Windows devices that are NOT enrolled for 'feature' updates\n$ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and\n $_.operatingSystem -like \"Windows*\" -and\n $StatusLookup.ContainsKey($_.azureADDeviceId) -and\n $StatusLookup[$_.azureADDeviceId].EnrollmentStateFeature -eq \"enrolling\" -or $StatusLookup[$_.azureADDeviceId].EnrollmentStateFeature -eq \"unenrolling\"\n}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n Invoke-MgGraphRequest -Method DELETE `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/$deviceId\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll Windows Client devices into WUfB AutoPatch (Feature Updates only) – will also include devices, that was deleted before (catch-up)<\/h2>\n\n\n\n
# Enroll Windows Client devices into WUfB AutoPatch (Feature Updates only) - will also include devices, that was deleted before (catch-up)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\n$ScopedDevices = $devices | Where-Object { $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"feature\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll Windows Client devices into WUfB AutoPatch with ‘NotEnrolled’ state (Feature Updates only)<\/h2>\n\n\n\n
# Enroll Windows Client devices into WUfB AutoPatch with 'NotEnrolled' state (Feature Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\nwrite-host \"Get enrollment status for devices ... Please Wait !\"\n$StatusEnrollmentWUfB = Get-WUfBEnrollmentStatus\n\n# Build a lookup dictionary from enrollment status for fast access\n$StatusLookup = @{}\nforeach ($entry in $StatusEnrollmentWUfB) {\n $StatusLookup[$entry.DeviceId] = $entry\n}\n\n# Filter: MDM-managed Windows devices that are NOT enrolled for 'feature' updates\n$ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and\n $_.operatingSystem -like \"Windows*\" -and\n $StatusLookup.ContainsKey($_.azureADDeviceId) -and\n $StatusLookup[$_.azureADDeviceId].EnrollmentStateFeature -eq \"notEnrolled\" # filter for 'NotEnrolled' state. We don't want to include 'unenrolling', but let them finish first\n}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n #####################\n # Feature Updates\n #####################\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"feature\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Force Un-enroll Windows Client devices from WUfB AutoPatch (Feature Updates only)<\/h2>\n\n\n\n
# Force Un-enroll Windows Client devices from WUfB AutoPatch (Feature Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-unenrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\n$ScopedDevices = $devices | Where-Object { $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n # Build JSON body for (un)enrollment\n $body = @{\n updateCategory = \"feature\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/unenrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Force Delete All Windows Client devices from WUfB AutoPatch (Only use, if you want complete reset !!!)<\/h2>\n\n\n\n
# Force Delete All Windows Client devices from WUfB AutoPatch (Only use, if you want complete reset !!!)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-delete?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\n$ScopedDevices = $devices | Where-Object { $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n Invoke-MgGraphRequest -Method DELETE `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/$deviceId\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll All Windows Client devices into WUfB AutoPatch (Quality Updates only)<\/h2>\n\n\n\n
# Enroll All Windows Client devices into WUfB AutoPatch (Quality Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\n$ScopedDevices = $devices | Where-Object { $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n #####################\n # Quality Updates\n #####################\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"quality\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll All Windows Client devices into WUfB AutoPatch (Driver Updates only)<\/h2>\n\n\n\n
# Enroll All Windows Client devices into WUfB AutoPatch (Driver Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\n# Filter only Windows client devices managed by Intune\n$ScopedDevices = $devices | Where-Object { $_.managementAgent -eq \"mdm\" -and $_.operatingSystem -like \"Windows*\"}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n #####################\n # Driver Updates\n #####################\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"driver\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll Windows Client devices into WUfB AutoPatch with ‘NotEnrolled’ state (Quality Updates only)<\/h2>\n\n\n\n
# Enroll Windows Client devices into WUfB AutoPatch with 'NotEnrolled' state (Quality Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\nwrite-host \"Get enrollment status for devices ... Please Wait !\"\n$StatusEnrollmentWUfB = Get-WUfBEnrollmentStatus\n\n# Build a lookup dictionary from enrollment status for fast access\n$StatusLookup = @{}\nforeach ($entry in $StatusEnrollmentWUfB) {\n $StatusLookup[$entry.DeviceId] = $entry\n}\n\n# Filter: MDM-managed Windows devices that are NOT enrolled for 'feature' updates\n$ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and\n $_.operatingSystem -like \"Windows*\" -and\n $StatusLookup.ContainsKey($_.azureADDeviceId) -and\n $StatusLookup[$_.azureADDeviceId].EnrollmentStateQuality -eq \"notEnrolled\" # filter for 'NotEnrolled' state. We don't want to include 'unenrolling', but let them finish first\n}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n #####################\n # Quality Updates\n #####################\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"quality\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nIntune: Enroll Windows Client devices into WUfB AutoPatch with ‘NotEnrolled’ state (Driver Updates only)<\/h2>\n\n\n\n
# Enroll Windows Client devices into WUfB AutoPatch with 'NotEnrolled' state (Driver Updates only)\n\n# https:\/\/learn.microsoft.com\/en-us\/graph\/api\/windowsupdates-updatableasset-enrollassets?view=graph-rest-beta&tabs=http\n\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce5 Retrieving all devices from Intune...\"\n\n$devices = @()\n$uri = \"https:\/\/graph.microsoft.com\/beta\/deviceManagement\/managedDevices\"\n\ndo {\n $response = Invoke-MgGraphRequest -Method GET -Uri $uri\n $devices += $response.value\n $uri = $response.'@odata.nextLink'\n} while ($uri)\n\nwrite-host \"Get enrollment status for devices ... Please Wait !\"\n$StatusEnrollmentWUfB = Get-WUfBEnrollmentStatus\n\n# Build a lookup dictionary from enrollment status for fast access\n$StatusLookup = @{}\nforeach ($entry in $StatusEnrollmentWUfB) {\n $StatusLookup[$entry.DeviceId] = $entry\n}\n\n# Filter: MDM-managed Windows devices that are NOT enrolled for 'feature' updates\n$ScopedDevices = $devices | Where-Object {\n $_.managementAgent -eq \"mdm\" -and\n $_.operatingSystem -like \"Windows*\" -and\n $StatusLookup.ContainsKey($_.azureADDeviceId) -and\n $StatusLookup[$_.azureADDeviceId].EnrollmentStateDriver -eq \"notEnrolled\" # filter for 'NotEnrolled' state. We don't want to include 'unenrolling', but let them finish first\n}\nWrite-Host \"\"\nWrite-Host \"\u2705 Scoped devices found: $($ScopedDevices.Count)\"\n\n# === LOOP THROUGH DEVICES ===\nforeach ($device in $ScopedDevices) {\n $deviceName = $device.deviceName\n $deviceId = $device.azureADDeviceId\n\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Processing device: $deviceName ($deviceId)\"\n\n #####################\n # Driver Updates\n #####################\n # Build JSON body for enrollment\n $body = @{\n updateCategory = \"driver\"\n assets = @(\n @{\n \"@odata.type\" = \"#microsoft.graph.windowsUpdates.azureADDevice\"\n id = $deviceId\n }\n )\n }\n $jsonBody = $body | ConvertTo-Json -Depth 5\n\n Invoke-MgGraphRequest -Method POST `\n -Uri \"https:\/\/graph.microsoft.com\/beta\/admin\/windows\/updates\/updatableAssets\/enrollAssets\" `\n -Body $jsonBody `\n -ContentType \"application\/json\"\n}<\/code><\/pre>\n\n\n\nEndpoint: Windows client troubleshooting<\/h2>\n\n\n\n
![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/05\/image-6-1024x565.png\")
<\/figure>\n\n\n\n<#\n .NAME\n Windows Client Troubleshooting (\n\n .SYNOPSIS\n\n .NOTES\n \n .VERSION\n 1.0\n \n .AUTHOR\n Morten Knudsen, Microsoft MVP - https:\/\/mortenknudsen.net\n\n .LICENSE\n Licensed under the MIT license.\n\n .PROJECTURI\n https://github.com\/KnudsenMorten\/Intune-Windows-Update-Troubleshooting\n\n\n .WARRANTY\n Use at your own risk, no warranty given!\n#>\n\n# === CONFIGURATION ===\n$CollectCompleteLogs = $false\n$CollectWULogsOnly = $false\n$RunSystemRepairs = $false\n$RunWUReset = $true\n$RunPolicySimulation = $true\n$RunWUCheck = $true\n$RunTelemetryCheck = $true\n$RunIMECheck = $true\n$RunDSREGCheck = $true\n$RunIMERepair = $false\n\n\n# === SETUP ===\n$LogPath = \"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs\\FeatureUpdateValidation.log\"\nNew-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null\nStart-Transcript -Path $LogPath -Append\n\n\n# === ADMIN CHECK ===\nif (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(\n [Security.Principal.WindowsBuiltInRole]::Administrator)) {\n Write-Host \"\"\n Write-Host \"\u274c Please run this script as Administrator.\"\n Stop-Transcript\n exit 1\n}\n\n\n# === SYSTEM REPAIR SECTION ===\nif ($RunSystemRepairs) {\n Write-Host \"\"\n Write-Host \"\u2699 Performing system file integrity checks...\"\n sfc \/scannow\n dism \/online \/cleanup-image \/scanhealth\n DISM \/Online \/Cleanup-Image \/RestoreHealth\n Dism.exe \/online \/Cleanup-Image \/StartComponentCleanup \/ResetBase\n}\n\n\n# === TELEMETRY & SERVICE CHECKS ===\nif ($RunTelemetryCheck) {\n Write-Host \"\"\n Write-Host \"\ud83d\udd0d Checking telemetry and diagnostics settings...\"\n\n function Check-RegistryValue {\n param ([string]$Path, [string]$Name)\n try {\n $value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop\n return $value.$Name\n } catch {\n return $null\n }\n }\n\n $diagTrack = Get-Service -Name \"DiagTrack\" -ErrorAction SilentlyContinue\n Write-Host \"\"\n if ($diagTrack -and $diagTrack.Status -eq 'Running') {\n Write-Host \"\u2705 DiagTrack service is running.\"\n } else {\n Write-Host \"\u274c DiagTrack service is not running.\"\n }\n\n $telemetryLevel = Check-RegistryValue -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\" -Name \"AllowTelemetry\"\n Write-Host \"\"\n if ($telemetryLevel -ge 3) {\n Write-Host \"\u2705 Telemetry Level: $telemetryLevel\"\n } else {\n Write-Host \"\u274c Telemetry Level too low: $telemetryLevel (min: 3)\"\n }\n\n $policyTelemetry = Check-RegistryValue -Path \"HKLM:\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\System\" -Name \"AllowTelemetry\"\n Write-Host \"\"\n if ($policyTelemetry) {\n Write-Host \"\u2705 PolicyManager Telemetry Level: $policyTelemetry\"\n } else {\n Write-Host \"\u274c PolicyManager Telemetry Level not set.\"\n }\n\n $commercialId = Check-RegistryValue -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\" -Name \"CommercialId\"\n Write-Host \"\"\n if ($commercialId) {\n Write-Host \"\u2705 Commercial ID set: $commercialId\"\n } else {\n Write-Host \"\u274c Commercial ID not set.\"\n }\n\n $safeguardHold = Check-RegistryValue -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TargetVersionUpgradeExperienceIndicators\" -Name \"UpgEx\"\n Write-Host \"\"\n if ($safeguardHold) {\n Write-Host \"\u274c Safeguard Hold Detected: $safeguardHold\"\n } else {\n Write-Host \"\u2705 No Safeguard Holds detected.\"\n }\n}\n\n\n# === WINDOWS UPDATE CHECK ===\nif ($RunWUCheck) {\n Write-Host \"\"\n Write-Host \"\ud83e\uddf9 Checking for and removing policy keys that block Windows Update...\"\n\n $pathsToClean = @(\n @{ Path = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\"; Name = \"DoNotConnectToWindowsUpdateInternetLocations\" },\n @{ Path = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\"; Name = \"DisableWindowsUpdateAccess\" },\n @{ Path = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\"; Name = \"NoAutoUpdate\" }\n )\n\n foreach ($item in $pathsToClean) {\n try {\n $property = Get-ItemProperty -Path $item.Path -Name $item.Name -ErrorAction SilentlyContinue\n if ($null -ne $property) {\n Remove-ItemProperty -Path $item.Path -Name $item.Name -ErrorAction SilentlyContinue\n Write-Host \"\u2705 Removed $($item.Name) from $($item.Path)\"\n }\n } catch {\n # Do nothing\n }\n }\n}\n\n\n\n\n# === WINDOWS UPDATE RESET ===\nif ($RunWUReset) {\n Write-Host \"\"\n Write-Host \"\ud83d\udd04 Performing Windows Update Reset...\"\n\n Stop-Service wuauserv -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Stop-Service bits -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Stop-Service cryptSvc -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Stop-Service msiserver -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Stop-Service uhssvc -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n\n $sdPath = \"C:\\Windows\\SoftwareDistribution\"\n $catrootPath = \"C:\\Windows\\System32\\catroot2\"\n\n if (Test-Path $sdPath) {\n Remove-Item -Path $sdPath -Recurse -Force -ErrorAction SilentlyContinue\n New-Item -Path $sdPath -ItemType Directory -Force | Out-Null\n }\n\n if (Test-Path $catrootPath) {\n Remove-Item -Path $catrootPath -Recurse -Force -ErrorAction SilentlyContinue\n New-Item -Path $catrootPath -ItemType Directory -Force | Out-Null\n }\n\n Start-Service wuauserv -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Start-Service bits -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Start-Service cryptSvc -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Start-Service msiserver -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Start-Service uhssvc -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n\n Write-Host \"\"\n Write-Host \"\u2705 Windows Update services restarted and folders reset.\"\n}\n\n\n# === DSREG STATUS ===\nif ($RunDSREGCheck) {\n Write-Host \"\"\n Write-Host \"\ud83d\udd10 Checking Entra ID Join Status...\"\n $aad = dsregcmd \/status | Select-String \"AzureAdJoined\"\n $hybrid = dsregcmd \/status | Select-String \"DomainJoined\"\n\n Write-Host \"\"\n if ($aad -match \"YES\") {\n Write-Host \"\u2705 Device is Enta ID joined.\"\n } else {\n Write-Host \"\u274c Not Entra ID joined.\"\n }\n\n Write-Host \"\"\n if ($hybrid -match \"YES\") {\n Write-Host \"\u2705 Device is Hybrid joined.\"\n } else {\n Write-Host \"\u274c Not Hybrid joined.\"\n }\n}\n\n\n# === INTUNE MANAGEMENT EXTENSION CHECK ===\nif ($RunIMECheck) {\n Write-Host \"\"\n Write-Host \"\ud83d\udee0 Restarting Intune Management Extension...\"\n Stop-Service IntuneManagementExtension -Force -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n Start-Service IntuneManagementExtension -ErrorAction SilentlyContinue -WarningAction SilentlyContinue\n}\n\n# === INTUNE MANAGEMENT EXTENSION REPAIR ===\nif ($RunIMERepair) {\n # Uninstall\n msiexec \/x \"{1F8496D2-52D3-4DA4-BC6D-48A74D1C42E0}\" \/quiet \/norestart\n\n # Re-download and reinstall\n Invoke-WebRequest \"https:\/\/go.microsoft.com\/fwlink\/?linkid=2156826\" -OutFile \"$env:TEMP\\IME.msi\"\n Start-Process msiexec.exe -ArgumentList \"\/i `\"$env:TEMP\\IME.msi`\" \/quiet \/norestart\" -Wait\n}\n\n\n# === POLICY SIMULATION ===\nif ($RunPolicySimulation) {\n Write-Host \"\"\n Write-Host \"\ud83d\udd12 Simulating MDM policy update to trigger MDM policy to refresh...\"\n reg add \"HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\System\" \/v \"DummyPolicy\" \/t REG_DWORD \/d 1 \/f >$null 2>&1\n Start-Sleep -Seconds 3\n reg delete \"HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\System\" \/v \"DummyPolicy\" \/f >$null 2>&1\n Write-Host \"\"\n Write-Host \"\u2705 Policy refresh simulated.\"\n}\n\n\n# === LOG COLLECTION ===\nif ($CollectCompleteLogs) {\n Write-Host \"\"\n Write-Host \"\ud83d\udcc1 Collecting logs...\"\n\n $timestamp = Get-Date -Format \"yyyy-MM-dd_HH-mm-ss\"\n $tempFolder = \"C:\\Temp\\IntuneLogs_$timestamp\"\n $zipPath = \"$tempFolder.zip\"\n\n New-Item -ItemType Directory -Path $tempFolder -Force | Out-Null\n\n wevtutil epl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\/Admin\" \"$tempFolder\\MDM_EventLog.evtx\"\n wevtutil epl \"Microsoft-Windows-WindowsUpdateClient\/Operational\" \"$tempFolder\\WU_EventLog.evtx\"\n Get-WindowsUpdateLog -LogPath \"$tempFolder\\WindowsUpdate.log\"\n\n mdmdiagnosticstool.exe -area \"DeviceProvisioning;DeviceEnrollment;Autopilot;DeviceManagementEnterprise-Diagnostics-Provider;Accounts;ModernApps;Connectivity;WNS;PushNotifications\" -cab \"$tempFolder\\MDMDiag.cab\"\n expand.exe \"$tempFolder\\MDMDiag.cab\" -F:* $tempFolder\n Remove-Item \"$tempFolder\\MDMDiag.cab\" -Force\n\n Compress-Archive -Path $tempFolder\\* -DestinationPath $zipPath -Force\n\n Write-Host \"\"\n Write-Host \"\u2705 Logs collected and saved to: $zipPath\"\n}\n\nif ($CollectWULogsOnly) {\n Write-Host \"\"\n Write-Host \"\ud83d\udce4 Building Windows Update Logs ... Please Wait !\"\n $timestamp = Get-Date -Format \"yyyy-MM-dd_HH-mm-ss\"\n $tempFolder = \"C:\\Temp\\IntuneLogs_$timestamp\"\n\n New-Item -ItemType Directory -Path $tempFolder -Force | Out-Null\n\n Get-WindowsUpdateLog -LogPath \"$tempFolder\\WindowsUpdate.log\" -ForceFlush -Confirm:$false\n}\n\n\n# === FORCE COMPATIBILITY DATA SUBMISSION | Touching or updating LastDeviceScanTime can help re-initiate the compatibility assessment pipeline ===\nWrite-Host \"\"\nWrite-Host \"\ud83d\udce4 Forcing compatibility data submission to Windows Update for Business...\"\n\n# This registry key is often touched to ensure data is reprocessed\n$null = New-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TargetVersionUpgradeExperienceIndicators\" `\n -Name \"LastDeviceScanTime\" -Value ([System.Management.ManagementDateTimeConverter]::ToDmtfDateTime((Get-Date))) `\n -PropertyType String -Force\n\nStart-Process -FilePath \"C:\\Windows\\System32\\compattelrunner.exe\" -ArgumentList \"-maintenance\" -NoNewWindow -Wait\n\nWrite-Host \"\u2705 Compatibility scan & data submission triggered.\"\n\n\n# Scan for updates (recommended method)\nwrite-host \"Trigger 'Scan for Updates'\"\nUsoClient StartScan\nwuauclt \/detectnow\n\n# UsoClient StartDownload # Begin downloading available updates\n# UsoClient StartInstall # Install downloaded updates\n# UsoClient ScanInstallWait # Full flow: scan + download + install\n\n\n# PSWindowsUpdate method\n<# \n Get-WindowsUpdate -MicrosoftUpdate\n#>\n\n# COM method\n<# \n $UpdateSession = New-Object -ComObject Microsoft.Update.Session\n $UpdateSearcher = $UpdateSession.CreateUpdateSearcher()\n $SearchResult = $UpdateSearcher.Search(\"IsInstalled=0\")\n $SearchResult.Updates | Select-Object Title, IsDownloaded, IsInstalled\n#>\n\nStop-Transcript\n<\/code><\/pre>\n\n\n\n