How to block a particular KB updating on windows devices using Intune

Question

KB5017308 is causing issue in our infra. We have update rings set on all co-manged devices because of this the KB is already installed on device and now its causing trouble due to known issues. Is there a way to block this KB from installing via Intune policy or can this be removed from devices where it is already installed?

Answer 1

Intune doesn't have any control on the what updates to install or remove and it doesn't provide any media to the devices as well , it simply control the windows update settings such as when to install, when to reboot etc.

If you know there is an issue with updates, all you can do is, pause the update ring or uninstall the update ring policy.

You can use powershell script or create win32 app to remove the specific patch from the devices where it is installed using the detection rule or so.

Thanks,
Eswar
www.eskonr.com

Answer 2

Hello there,

There is no built-in way to do that. You could pause Quality updates https://learn.microsoft.com/en-us/intune/protect/windows-update-for-business-configure#pause but not block a specific update

Unfortunately there is no solution for this and I wonder if it is ever going to be. Also because most updates are cumulative. We decided in this case to use an onpremises WSUS server and with setting the registry keys to point to the WSUS server, the devices will only look for updates from this server and not directly online. With other policies we made sure that the user cannot override this.

--------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 3

We are 2 years later, what is the solution? how can we manage companies with Intune if we can't block KB's causing issues ....