Operating System Updates (Windows)

In this article, you will learn everything you need to know about the Operating System Updates product.

1. Description
2. How do Operating System Updates work?
3. HEIMDAL Agent - Operating System Updates
4. Operating System Updates view
5. Operating System Updates settings

DESCRIPTION

With Patch and Asset Management, you can install Operating System Updates on the Windows computers in your company’s environment. The Patch & Asset Management – Operating System Updates module allows the management of these patches, selecting which ones to deploy on the computers under the respective Group Policy, deleting or hiding them, and selecting to suppress the reboot of the endpoints (on updates that require a reboot to complete installation), as well as scheduling when the computers are to be restarted.

HOW DO OPERATING SYSTEM UPDATES WORK?

Operating System Updates checks the installed and available Operating System Updates on an endpoint and reports them to the HEIMDAL Dashboard.

The Administrator can deploy and install available Windows Updates with two methods: 
A. Manual deployment and installation of Windows Updates means that the HEIMDAL Dashboard Administrator can manually select the available update(s) to be deployed right from the HEIMDAL Dashboard -> Products -> Patch & Asset Management -> Operating System Updates. 
B. Automatic deployment and installation of Operating System Updates means that the HEIMDAL Dashboard Administrator can configure the automatic deployment and installation of available Operating System Updates through the HEIMDAL Agent. 
Windows Updates are available for installation when they are made available on the Server Source (e.g., WSUS Server or the Microsoft API). 

• Change scheduler settings (allows the HEIMDAL Agent to bypass the Windows settings to control the restart mechanism if Microsoft Update Reboot Schedule is enabled in the Group Policy)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate - ActiveHoursEnd
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate - ActiveHoursStart
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate - SetActiveHours

• Change automatic updates settings (allows the HEIMDAL Agent to deactivate the automatic Windows Updates)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - AllowMUUpdateService (0 or 1)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - AUOptions (2)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - NoAutoUpdate (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - ScheduledInstallDay (0)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - ScheduledInstallTime (0)

• Set delivery optimization (enable/disable Windows Updates delivery optimization feature)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config - DODownloadMode (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config -DownloadMode_BackCompat (1)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings - DownloadMode (1)
When the OS Updates product is disabled, the HEIMDAL Agent will restore the registry keys to the previous settings. If Delivery Optimization is managed through an Active Directory GPO, the HEIMDAL Agent will not be able to set DODownloadMode to 1. 

The example above describes a scenario in which the OS Updates Reboot Delay is set with a Reboot Delay of 10 minutes and several 2 allowed postponements. 

HEIMDAL Agent - Windows Updates 

The HEIMDAL Agent displays information about the Installed Updates, the Available Updates, and the Pending Updates.

The HEIMDAL Agent allows the end-user to see the installed Windows Updates that were installed on a computer.

OPERATING SYSTEM UPDATES view

The Operating System Updates view displays all the information collected by the HEIMDAL Agent that is running on the endpoints in your organization. The collected information refers to the Operating System Updates that are available or installed by the HEIMDAL Agent and is divided between the Windows Updates installed on Windows endpoints and the Linux Updates installed on Linux endpoints.

At the top, you see a statistic regarding the number of installed updates, the number of Available/Pending updates, and the number of devices with errors.The collected information is placed in the following views: Installed, Pending, Available, Updates per Endpoint, and Compliance.

• Installed
  This view displays a table with Windows Updates that are installed on the endpoints in your organization with the following details: Title, KB, Severity, Endpoints, Servers, CVE, CVSS, Products, and Categories. 
  
  In the Installed view, you are allowed to select one or multiple entries and hide them from the view using the Hide Updates button from the dropdown menu. You can also use the Select GP dropdown menu to list the installed Windows Updates for the selected Group Policy.  The Show Hidden Updates radio button allows you to display all the hidden Windows Updates. The updates can be listed per update or per endpoint.
• Pending
  This view displays a table with Windows Updates that are pending to complete the installation on the endpoints in your organization with the following details: Title, KB, Severity, Endpoints, Servers, Reboot, CVE, CVSS, Products, and Categories. 
  In the Pending view, you are allowed to select one or multiple entries and remove or Hide them from the view using the Remove or Hide Updates buttons from the dropdown menu. You can also use the Select GP dropdown menu to list the pending Windows Updates for the selected Group Policy.  The Show Hidden Updates radio button allows you to display all the hidden Windows Updates. The updates can be listed per update or per endpoint.
• Available
  This view displays a table with Windows Updates that are available for installation on the endpoints in your organization with the following details: Title, KB, Severity, Endpoints, Servers, Reboot, CVE, CVSS, Products, and Categories. 
  In the Available view, you are allowed to select one or multiple entries and install, hide, or show them from the view using the Install or Hide Updates buttons from the dropdown menu. The Install option works to push updates only created on the impersonated customer tenant, meaning that it doesn't work to push on Reseller Master GPs. You can also exclude an update by KB number by selecting an update and applying the Exclude OS Updates action. This action works only for updates that have a KB number. If you want to exclude an update that does not have a KB number, you need to add it by title from the GP settings. You can also use the Select GP dropdown menu to list the pending Windows Updates for the selected Group Policy.  The Show Hidden Updates radio button allows you to display all the hidden Windows Updates. The updates can be listed per update or endpoint.
• Error
  This view includes a grid with the following columns: Hostname (clickable, will redirect to the OS Updates -> Pending tab), Username, Error code (with a tooltip for the error code's description), and Last Seen. The Reboot required view displays all the endpoints that need to be rebooted for their corresponding Windows Updates to be completed. 
  
• Assets
  This view displays a table with all the Windows Updates that have been installed since the OS installation, with the following details: Title, Endpoints, Servers, Client Application ID, and Description. This is a complete audit of the installed Windows Updates, regardless of whether the Heimdal Agent was installing them or not.
  
• Compliance
  This view displays a table with the compliant and non-compliant endpoints (in terms of installed Windows Updates) with the following days: Hostname, Username, Number of Updates, Highest Severity, Operating System, Oldest patch date, Last Seen, and Status.
  
  A Non-Compliant machine is an endpoint that has pending updates before the Specific Date set in the Filter and the Last Seen timestamp (not older than 6 months). The Non-compliant filter doesn't have an interval, as the Specific Date will suffice to show the Non-Compliant endpoints up to that date. The Compliance view considers the Cyber Essentials norms when deeming an endpoint as being compliant or not. The Cyber Essentials compliant view will display all endpoints that do not have any available/pending OS updates with a vintage of more than 14 days, or the OS Build version is not End of Life (EOL) or End of Service. The Cyber Essentials non-compliant view will display all endpoints that have at least one available/pending OS update with a release date older than 14 days, or the OS Build version is End of Life (EOL) or End of Service.
  
• System Restore
  This view displays a table with the restore points that help you leverage recovery workflows in case of mishaps: Hostname, Restore point name, and Timestamp.
  
  Selecting a restore point allows you to apply it to the chosen endpoint by clicking on Apply Restore Point. 

If you click on a specific update, you will enter the Update details page, which also contains the Update Rings view. This view will allow you significantly more control over how updates are rolled out across your environment. The tab displays all Group Policies that are configured to deploy the selected update, together with deployment delay information, installation statistics, and eligible endpoints.The following columns are available in the Update Rings view:

• Group Policy – name of the policy defining the deployment behavior for the select Window update.
• Delay - value reflecting either the “Delay update installation (days)” setting or a “per category” delay configured in Group Policy (the per category delay overrides the general delay). Windows Updates are installed after the specified number of days from their official release date.
• Delay Source – indicates whether the delay is defined at the category level or inherited from the general (Group Policy) delay.
• Installed Endpoints - number of endpoints where the Windows Update has been successfully installed within the selected Group Policy
• Eligible Endpoints - number of endpoints within the selected Group Policy scope that are eligible for the Windows Update (in Available, Pending, or Installed status).
• Total Endpoints - total number of endpoints associated with the selected Group Policy.
• Install Percentage (%) - percentage of eligible endpoints where the Windows Update has been successfully installed.

The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view. (Note: Although the release date for the OS updates is not shown in the Installed, Pending, and Available views, this piece of information is included in the Verbose CSV report if extracted from the mentioned views).

The Installed, Pending, and Available views, besides the standard Grid view, have an additional view called the Stats view, which can be toggled by switching from the Grid view.

This view contains statistical data regarding the OS Updates that are separated into Pie charts and matrix data. The info displayed shows the By severity pie chart graphs and the By release date matrices.
By clicking the data, you will be redirected to a pre-filtered view (date range and Severity) where you can visualize only the OS Updates that fall under that specific selection.

OPERATING SYSTEM UPDATES

The Operating System Updates module allows the Heimdal Dashboard Administrator(s) to view, download, and deploy available Operating System Updates that are specific to any endpoint in your environment. Patch & Assets allows you to select which updates to deploy on the computers applying the current Group Policy, to delete or hide them, and to suppress the reboot of the endpoints after the installation completes or schedule when the endpoints will reboot to complete the installation.
Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.

Operating System Updates - turns the Operating System Updates module ON or OFF.

General Settings

Operating System Updates reporting mode - retrieves the available updates for the endpoints in your environment (displayed in the OS Updates view) without installing them. While this option is enabled, the remaining settings of this tab are disabled.
Assets view - enables the audit of all updates installed on the computers running the Heimdal Agent in your environment.
Server Source - selects the channel the Heimdal Agent uses to fetch available updates:

• Default - uses the source configured on each device (e.g., WSUS or any other 3rd-party server). On Windows, this is the intranet Microsoft update service location configured in Local Group Policy Editor -> Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update, or the Microsoft default source if nothing is specified.
• Microsoft Catalog - bypasses any locally configured server and fetches the available updates directly from the Microsoft Update servers.

OS Updates check interval [minutes] - sets the interval (between 720 and 1440 minutes) the Heimdal Agent uses to automatically check for available updates. This option is only visible in Advanced mode.
Note: System Restore Management is configured in its own module under the General tab. System Restore is only available on Windows client operating systems; it is not supported on Windows Server.

Install Settings

Automatically install all available updates - enables the automatic download and installation of all the available updates released by Microsoft for your endpoints (both those that require a reboot to complete the installation and those that do not), except updates in the Upgrades category, which are managed with the Automatically install upgrades option. To complete the installation of an update that requires a reboot, the endpoint will reboot only if the end user reboots the computer manually or the Reboot schedule is configured to reboot automatically.
Automatically install no-restart-required updates only - enables the automatic download and installation of all the available updates that do NOT require a reboot to complete the installation process.
Automatically install updates by category - enables the automatic download and installation of the selected Microsoft Update categories only. This option is not available while Automatically install all available updates is enabled. Categories and a per-category delay (in days) can be selected from the table that appears when the option is enabled:

Note: The per-category delay takes precedence over the general delay set in Delay update installation [days].
Automatically install upgrades - automatically installs updates belonging to the Upgrades category (also known as Feature Updates, e.g., 20H2, 21H2, 22H2, 23H2, 24H2, 25H2). By default, this option is disabled to avoid unwanted feature updates from being applied to your devices (including servers). We recommend keeping this option disabled and manually selecting the Feature Updates to be installed from the OS Updates product page. When enabled, the following sub-option becomes available:

• Allow the user to postpone the upgrade - notifies the end user that an upgrade (feature update) is about to be installed and allows them to delay the installation. Once enabled, set the Postpone interval [minutes] (5 to 600 minutes) and the Number of allowed postpones (0 to 10). This option is not available while Hide Heimdal Agent UI is enabled in General Management.

Receive optional updates - allows you to receive the latest optional updates (served through the Optional Updates channel) that offer additional improvements and fixes beyond what is considered critical. These updates are installed automatically as long as one of the three automatic installation options is enabled (Automatically install all available updates, Automatically install no-restart-required updates only, or Automatically install updates by category). If none of these three options is enabled, the Heimdal Administrator can manually select one or multiple optional updates to be installed from the OS Updates product page.
Receive updates for other Microsoft products - allows you to receive the latest updates for Microsoft products (covered products are listed here). These updates are pushed automatically together with the other Windows Updates as long as one of the three automatic installation options is enabled. If none of these three options is enabled, the Heimdal Agent will not install any updates for other Microsoft products.
M365 Click to run updates - allows the Heimdal Agent to detect Microsoft 365 Click-to-Run installations automatically, perform silent version checks, and deploy updates through a dedicated backend integrated into the existing OS Updates lifecycle, so that these updates are visible and managed like all other OS updates.
Wingman Sequencing - when enabled, AI Wingman prioritizes OS updates based on their importance/urgency, installing the most critical updates first.
Prevent Windows 11 auto-upgrade - prevents the Heimdal Agent from automatically installing the upgrade to Windows 11 (the stable release). This option is only visible in Advanced mode.
Feature Update version lock - keeps the endpoints on a defined OS version, ensuring version consistency across the environment while preventing unintended upgrades. When enabled, select the Operating System and the Version (e.g., 22H2, 23H2) from the two dropdowns; devices applying the Group Policy remain on the selected Windows release and do not upgrade to newer versions until the policy is updated or removed. If an invalid or unsupported version is specified, the endpoint will remain frozen on its current OS version until a valid build is provided. We recommend creating separate Group Policies for each OS family (e.g., a dedicated policy for Windows 10, Windows 11, and Windows Server) to ensure accurate build enforcement. This behavior mirrors Microsoft's Select the target Feature Update version policy setting, enabling organizations to tightly control upgrade rollouts and reduce the operational risk associated with major OS transitions. Supported on Windows 10/11 and Windows Server 2016 or later. This option is only visible in Advanced mode.
Delay update installation [days] - postpones the installation of available updates by a specified number of days (1 to 31) after their release date, providing a controlled rollout period. This setting overrides the customization of the scheduler. This option is only visible in Advanced mode.

Updates marked for installation

This section allows the Heimdal Administrator to manually select individual updates for installation. The Heimdal Agent then verifies whether the chosen updates are actually required by the target endpoints and only installs them if they are officially served via the Microsoft Update API, ensuring applicability and authenticity. You can search the list by Title, KB, Products, Categories, or Added On, and tick Show Hidden Microsoft Updates to display hidden entries. The grid lists each update's Title, KB, Severity (as rated by Microsoft), Products, Categories, Release Date, Added On, and Suppress Reboot status, and allows you to hide or delete specific updates that are marked for installation. The grid is disabled while Automatically install all available updates is enabled.

Exclusions

OS Updates Exclusions - allows you to exclude specific updates from being installed by Update Name or KB. Exclusions take priority over updates that are manually marked for installation in the Group Policy. You can import a CSV file if you have multiple KBs or titles to exclude (a sample CSV file is available from the tooltip next to the option), search the existing exclusions, and export them with the Download OS Update Exclusions list .csv button. The grid lists each exclusion's Value and Type. This section is only visible in Advanced mode.

Install & Reboot Schedule

Install Schedule - allows you to configure the interval(s) when the installation of available updates takes place by selecting the day(s) in a week (Choose weekday) or in a month (Choose day of month), the Time Interval (00:00 to Midnight, minimum 2 hours), and whether the schedule is Active during time selection or Inactive during time selection. Choosing a day or multiple days (without selecting the weeks) will run the OS Updates on the selected days of every week. Choosing a day or multiple days (by selecting the First Week and the Second Week) will run the OS Updates on the selected days in the First Week and the Second Week only. The scheduler considers the way the days are distributed within the calendar.

In the example above, the month of September 2022 spans a period of 5 weeks. The First Week starts on the 1st of September, which means that the First Week includes only 4 days, while the Fifth Week includes 5 days. Choosing a combination of Thursday and the First Week means that the OS Updates will run on the 1st of September. Choosing a combination of Monday and the First Week means that the OS Updates will run on the 5th of September (the first day of the Second Week), because the first Monday of the month happens then. This prevents skipping a month if the selected day is out of scope. The other case refers to a combination of Sunday and the Fifth Week, where the last Sunday is out of the scope of the Fifth Week. Because the algorithm is adjusted so as not to skip any month, the OS Update scheduler will run on the 25th of September (which is the actual last Sunday of the month).

This feature is designed to allow you to schedule when the download and installation of updates take place, to minimize the impact on the workflow in your environment.

Reboot schedule - allows you to configure the interval(s) when an endpoint can reboot to complete the installation of available updates that require a reboot. The day/week/month selection, time interval, and Active/Inactive options work the same way as for the Install Schedule described above. In addition, the following option is available:

• Force reboot during time selection - forces the endpoint to reboot once during the selected interval, even if no updates that require a reboot have been installed.

This feature is designed to allow you to schedule when an endpoint can reboot to complete the installation of updates that require a reboot, to minimize the impact on the workflow in your environment.

Allow the user to postpone the reboot - available under the Reboot schedule in Advanced mode, this option allows the end user to defer the reboot required by an update for a limited period, enabling them to complete critical tasks without unexpected reboots. Once enabled, set the Postpone interval [minutes] (5 to 600 minutes) and the Number of allowed postpones (0 to 10). This option is not available while Force reboot during time selection is enabled.
Enhanced reboot detection - runs an additional post-installation check to reliably determine whether a Windows Update requires an operating system reboot, providing accurate status and preventing unnecessary restarts or overlooked completion steps. If a Windows Update does not install successfully, this option may trigger a reboot notification every 24 hours. This option is only visible in Advanced mode.
Pending reboot Agent notification - enables/disables the Reboot Required notification displayed by the Heimdal Agent on the end-user computer whenever a system restart is pending to complete the installation of a Windows Update.

Delivery Optimization Settings

Delivery Optimization - reduces bandwidth consumption by sharing the work of downloading available update packages among multiple devices within the organization.
Limit maximum download bandwidth - sets the maximum foreground and background download bandwidth, in kilobytes/second (1 to 1,022,976; default 5120), that the device can use across all concurrent download activities.

IMPORTANT

OS Updates is not designed to support the installation of Windows Updates that are approved via WSUS. Although an endpoint can be pointed to look for updates on a WSUS location, the Heimdal Agent is not able to discover the updates approved in WSUS and install them. The recommendation is to allow Heimdal's OS Updates to manage them by searching for and installing them directly from the Microsoft Update servers.