This policy setting specifies when computers in your environment will receive security updates from Windows Update or WSUS. The recommended state for this setting is: 0 - Every day. Note: This setting is only applicable if 4 - Auto download and schedule the install is selected in Rule 18.9.102.2. It will have no impact if any other option is selected. Rationale: Although each version of Windows is thoroughly tested before release, it is possible that problems will be discovered after the products are shipped. The Configure Automatic Updates setting can help you ensure that the computers in your environment will always have the most recent critical operating system updates and service packs installed. Impact: If 4 - Auto download and schedule the install is selected in Rule 18.9.102.2, critical operating system updates and service packs will automatically download every day (at 3:00 A.M., by default).
Solution
To establish the recommended configuration, set the following Device Configuration Policy to 0 - Every day To access the Device Configuration Policy from the Intune Home page: Click Devices Click Configuration profiles Click Create profile Select the platform (Windows 10 and later) Select the profile (Custom) Click Create Enter a Name Click Next Configure the following Setting Name: <Enter name> Description: <Enter Description> OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallDay Data type: Integer Value: 0 Select OK Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.) Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy. Default Value: Not Defined. (Since the default value of Configure Automatic Updates is 3 - Auto download and notify for install, this setting is not applicable by default.)