Patch compliance dashboard reporting incorrect update status

Question

Hi

We've been troubleshooting an issue with our patch compliance reporting and have run into an inconsistency that we haven't been able to explain. Our compliance dashboard continues to report one of our Windows servers as fully patched, even though we've manually verified that several recently released critical security updates are still missing from the system. We've already confirmed the missing updates by checking the installed update history and comparing it with the latest available updates, but the dashboard status never changes. We've also retried update scans and waited for the compliance data to refresh, yet the server is still incorrectly marked as compliant.

Please explain the recommended uindows update agent cache cleanup and scan diagnostic process to determine why the compliance status is inaccurate, and how we can force the server to report its actual update state correctly ?

Answer 1

Hello Jian Wong, thank you for posting in the Microsoft Q&A community.

The standard approach is to completely reset the local Windows Update components and clear the cache. This removes the stale assessment data and forces the server to download fresh update metadata from your update server or Microsoft directly.

Please run the following commands in an elevated PowerShell prompt to reset the update cache and initiate a fresh scan:

# Stop the Windows Update, Cryptographic, Background Intelligent Transfer Service, and Windows Installer services
Stop-Service -Name wuauserv, cryptSvc, bits, msiserver -Force
 
# Rename the SoftwareDistribution and Catroot2 folders to clear the update cache
Rename-Item -Path "$env:windir\SoftwareDistribution" -NewName "SoftwareDistribution.old" -Force
Rename-Item -Path "$env:windir\System32\catroot2" -NewName "catroot2.old" -Force
 
# Restart the stopped services
Start-Service -Name wuauserv, cryptSvc, bits, msiserver
 
# Force the server to scan against the configured update source
usoclient.exe StartScan

(Note: Renaming these folders is a safe and standard procedure. Windows will automatically recreate clean, empty versions of them the next time the update service starts. The update history displayed in the Windows Settings GUI will be cleared, but the actual installed updates are permanently registered in the underlying OS Component Store and will not be impacted.)

If clearing the cache does not correct the dashboard status after waiting for your compliance tool's reporting cycle, we may be dealing with a policy or telemetry reporting block. As an alternative workaround, you can ensure the system's management policies are fully refreshed and trigger a manual telemetry sync:

# Force an immediate update of Group Policy settings
gpupdate /force

For more detailed information regarding Windows Update architecture and diagnostics, you can refer to the official Microsoft documentation here: https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting