Blog Post

Microsoft Security Baselines Blog
2 MIN READ

Windows Update Baseline joins the Security Compliance Toolkit

Rick_Munck's avatar
Rick_Munck
Icon for Microsoft rankMicrosoft
Jan 26, 2021
  We are excited to announce the Update Baseline is now a part of the Security Compliance Toolkit! The Update Baseline is a new security baseline to ensure devices on your network get the latest Wi...
Published Jan 26, 2021
Version 1.0
John Siewert's avatar
John Siewert
Copper Contributor
Apr 16, 2021

Thanks Kay_Toma,

 

The VMs I have used for testing have been deployed via MDT using a custom gold image but I have the update steps in the Task Sequence disabled for these deployments.  I also don't domain join them during OSD so I can take a checkpoint of the fresh deployment and then join the domain into my test OU.  So these machines should not have any previous policy remnants getting in the way.

 

I changed the settings you suggested yesterday in the test policy and then deployed a new VM to test the policy.  Updates were installed yesterday and now I am just watching to see if I get any notifications before restarting.  The Start Menu Power indicates updates need a restart as does the Taskbar icon.  I haven't seen a toast notification yet though.

 

I have seen references to the registry key "restartnotificationsallowed2" in HKLM\Microsoft\WindowsUpdate\UX\Settings and setting the value to 1.  I have tried that and yet the option in Settings>Update & Security > Windows Update > Advanced options for "Show a notification when your PC requires a restart to finish updating"  remains Off and is unchangeable as it says it is managed by my organization.  Should that registry key be set?

 

- John