MD-102 Maintaining Windows 2 — Questions and Answers

Question 1: Which Windows Update for Business policy type controls when quality updates (monthly cumulative updates) are installed on managed devices?

Feature update policy
Quality update policy via Update ring (Correct answer)
Driver update policy
Expedite update policy

Correct answer: Quality update policy via Update ring

Update rings in Windows Update for Business define deferral periods and deadlines for quality updates, controlling when monthly cumulative updates are installed on groups of devices.

Update rings (configured as Windows 10/11 Update Ring policies in Intune) define settings for quality updates including deferral days, deadline days, and restart behaviour. Administrators typically create multiple rings (Pilot, Broad, Critical) with staggered deferrals to test updates on a subset of devices before broad rollout. Feature update policies control major OS version upgrades, while expedite policies force immediate installation of critical security updates.

Question 2: What is the recommended maximum deferral period for quality (security) updates in Windows Update for Business?

7 days
30 days (Correct answer)
60 days
90 days

Correct answer: 30 days

Microsoft recommends deferring quality updates by no more than 30 days to ensure devices receive critical security patches in a timely manner while still allowing validation time.

While Windows Update for Business allows quality update deferrals of up to 30 days, Microsoft recommends keeping deferrals at 7-30 days maximum to balance patch validation with security exposure. Longer deferrals leave devices vulnerable to known exploits. The feature update deferral can be up to 365 days. For critical security vulnerabilities, Intune's expedite update feature can override deferral settings to push patches immediately.

Question 3: An administrator needs to check which Windows updates are installed on a specific managed device from the Intune portal. Where should they look?

Devices > Device compliance
Devices > Monitor > Windows Update > Feature update failures
Devices > Select device > Monitor > Windows update installations (Correct answer)
Reports > Endpoint analytics > Device performance

Correct answer: Devices > Select device > Monitor > Windows update installations

In Intune, navigating to a specific device and selecting Monitor then Windows update installations shows the update history for that device, including installed updates and any failures.

Within the Microsoft Intune admin centre, selecting a specific device and navigating to Monitor > Windows update installations provides a history of updates installed on that device, including the update category, installation date, and status. The broader Windows update reports under Devices > Monitor provide fleet-wide update compliance reporting but are not per-device history views.

Question 4: Which PowerShell cmdlet is used to check the current Windows Update client policy settings applied to a device?

Get-WindowsUpdate
Get-WUSettings (Correct answer)
Get-MpComputerStatus
Get-WmiObject -Class Win32_QuickFixEngineering

Correct answer: Get-WUSettings

Get-WUSettings from the PSWindowsUpdate module retrieves the current Windows Update settings applied to a device, including server URLs, notification settings, and scheduled install times.

The PSWindowsUpdate PowerShell module provides Get-WUSettings to view current Windows Update client configuration, and Get-WindowsUpdate to list available or installed updates. Get-WmiObject with Win32_QuickFixEngineering lists installed hotfixes from WMI but does not show policy settings. Get-MpComputerStatus is for Microsoft Defender Antivirus status, not Windows Update settings.

Question 5: A user's Windows device has stopped receiving updates. After investigating, you find the Windows Update service is stopped. Which command restarts the service?

Start-Service -Name 'BITS'
Start-Service -Name 'wuauserv' (Correct answer)
net start WindowsUpdate
Set-Service wuauserv -StartupType Automatic

Correct answer: Start-Service -Name 'wuauserv'

The Windows Update service internal name is wuauserv, and using Start-Service with this name restarts it so the device can check for and receive updates again.

The Windows Update service runs as wuauserv (Windows Update Automatic Update Service). Running Start-Service -Name wuauserv starts the service immediately. To also ensure it starts automatically after reboots, Set-Service wuauserv -StartupType Automatic should be run first. BITS (Background Intelligent Transfer Service) handles downloading update files but the core update check-in service is wuauserv.

Question 6: Which Intune report shows how many devices in the organisation are compliant with the Windows Update policy and which have failed to install required updates?

Endpoint analytics Startup performance
Windows Update compliance report (Correct answer)
Device configuration profile assignment report
Audit logs report

Correct answer: Windows Update compliance report

The Windows Update compliance report in Intune provides an overview of devices update status, showing which are up to date, which have pending updates, and which have encountered update failures.

Intune's Windows Update reports (under Reports > Windows Updates) provide fleet-wide visibility into update compliance, including feature update status, quality update status, and per-device detail. Administrators can see which devices are behind, which failed updates, and drill into specific error codes. Endpoint analytics focuses on performance metrics like startup times and app reliability rather than update compliance status.

MD-102 Maintaining Windows 2

Which Windows Update for Business policy type controls when quality updates (monthly cumulative updates) are installed on managed devices?