Detections
Analytics
18.9.108.2.1 (L1) Ensure 'Configure Automatic Updates' is set to 'Enabled'
Information
This policy setting specifies whether computers in your environment will receive security updates from Windows Update or WSUS. If you configure this policy setting to Enabled, the operating system will recognize when a network connection is available and then use the network connection to search Windows Update or your designated intranet site for updates that apply to them.After you configure this policy setting to Enabled, select one of the following three options in the Configure Automatic Updates Properties dialog box to specify how the service will work:
- 2 - Notify for download and auto install
(Notify before downloading any updates)
- 3 - Auto download and notify for install
(Download the updates automatically and notify when they are ready to be installed.) (Default setting)
- 4 - Auto download and schedule the install
(Automatically download updates and install them on the schedule specified below.))
- 5 - Allow local admin to choose setting
(Leave decision on above choices up to the local Administrators (Not Recommended))
The recommended state for this setting is: Enabled
Note: The sub-setting '
Configure automatic updating:
' has 4 possible values - all of them are valid depending on specific organizational needs, however if feasible we suggest using a value of 4 - Auto download and schedule the install This suggestion is not a scored requirement.
Note #2: Organizations that utilize a 3rd-party solution for patching may choose to exempt themselves from this recommendation, and instead configure it to Disabled so that the native Windows Update mechanism does not interfere with the 3rd-party patching process.
Although each version of Windows is thoroughly tested before release, it is possible that problems will be discovered after the products are shipped. The Configure Automatic Updates setting can help you ensure that the computers in your environment will always have the most recent critical operating system updates and service packs installed.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled :Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates
Note: This Group Policy path is provided by the Group Policy template WindowsUpdate.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.
Impact:
Critical operating system updates and service packs will be installed as necessary.
See Also
Item Details
Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY
References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4
Plugin: Windows
Control ID: a8a75001a3798f00a94741f208cf4db972e4d1d57c3cfb3ef69780270407c827