L1 BIO 12.06.02 ISO A.12.6.1 CIS Windows - Feature deferral

Intune: Defer Feature Updates 180+ Days

📅 2025-10-30
•
⏱️ 2 minuten lezen
•
🟢 Should-Have

💼 Management Samenvatting

Defer feature updates 180+ days - enterprise testing period voor major OS releases (stability over bleeding-edge).

Aanbeveling
IMPLEMENT
Risico zonder
Low
Risk Score
3/10
Implementatie
12u (tech: 2u)
Van toepassing op:
✓ Windows 10
✓ Windows 11

180-day deferral = enterprise standard: Feature updates: Major OS changes (22H2, 23H1, 24H2), Risks: App compatibility breaks, driver issues, UI changes (user retraining), Early bugs: First 90 days = bug discovery period (Microsoft patches issues). 180-day deferral: Months 1-3: Early adopters find bugs → Microsoft patches, Months 4-6: Enterprise pilots test → app compatibility verification, Month 6+: Production rollout (stable + tested). CIS/Microsoft: 180 days minimum (recommended).

PowerShell Modules Vereist
Primary API: Microsoft Graph API
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

180-day deferral: Policy: Defer feature updates: 180 days, Effect: Windows 11 24H2 released → production devices receive 6 months later (stable), Quality updates: NOT deferred (0 days - immediate security patches), Deployment: Pilot (0 days) → Early adopters (30-90 days) → Production (180 days).

Vereisten

  1. Intune subscription
  2. Windows 10/11
  3. Deployment rings: Pilot + Production
  4. App compatibility testing process

Implementatie

Intune: Windows Update ring (Production) → Feature update deferral: 180 days. Quality deferral: 0 days. Pilot ring: 0-30 days (testing).

Compliance

CIS Windows Benchmark (180+ days), BIO 12.06, ISO 27001 A.12.6.1.

Monitoring

Gebruik PowerShell-script defer-feature-updates-period-in-days-is-set-to-enabled-180-or-more-days.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script defer-feature-updates-period-in-days-is-set-to-enabled-180-or-more-days.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Intune Update Management: Defer Feature Updates 180+ Days .DESCRIPTION CIS - Feature updates moeten 180+ dagen gedeferred voor stabiliteit. .NOTES Filename: defer-feature-updates.ps1|Author: Nederlandse Baseline voor Veilige Cloud|Registry: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdates|Expected: 1, DeferFeatureUpdatesPeriodInDays >= 180 #> #Requires -Version 5.1 #Requires -RunAsAdministrator [CmdletBinding()]param([switch]$WhatIf, [switch]$Monitoring, [switch]$Remediation, [switch]$Revert) $ErrorActionPreference = 'Stop'; $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; $MinDays = 180 function Connect-RequiredServices { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } function Test-Compliance { $r = [PSCustomObject]@{ScriptName = "defer-feature-updates.ps1"; PolicyName = "Defer Feature Updates"; IsCompliant = $false; CurrentValue = $null; ExpectedValue = "$MinDays+ days"; Details = @() }; function Invoke-Revert { Remove-ItemProperty -Path $RegPath -Name "DeferFeatureUpdates" -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $RegPath -Name "DeferFeatureUpdatesPeriodInDays" -ErrorAction SilentlyContinue } try { if (Test-Path $RegPath) { $defer = Get-ItemProperty -Path $RegPath -Name "DeferFeatureUpdates" -ErrorAction SilentlyContinue; $days = Get-ItemProperty -Path $RegPath -Name "DeferFeatureUpdatesPeriodInDays" -ErrorAction SilentlyContinue; if ($defer -and $defer.DeferFeatureUpdates -eq 1 -and $days -and $days.DeferFeatureUpdatesPeriodInDays -ge $MinDays) { $r.IsCompliant = $true; $r.CurrentValue = "$($days.DeferFeatureUpdatesPeriodInDays) days"; $r.Details += "Feature updates deferred $($days.DeferFeatureUpdatesPeriodInDays) days" }else { $r.CurrentValue = "$($days.DeferFeatureUpdatesPeriodInDays) days"; $r.Details += "Onvoldoende defer period" } }else { $r.Details += "Niet geconfigureerd" } }catch { $r.Details += "Error: $($_.Exception.Message)" }; return $r } function Invoke-Remediation { if (-not(Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null }; Set-ItemProperty -Path $RegPath -Name "DeferFeatureUpdates" -Value 1 -Type DWord -Force; Set-ItemProperty -Path $RegPath -Name "DeferFeatureUpdatesPeriodInDays" -Value $MinDays -Type DWord -Force; Write-Host "Feature updates deferred $MinDays days" -ForegroundColor Green } function Invoke-Monitoring { $r = Test-Compliance; Write-Host "`n$($r.PolicyName): $(if($r.IsCompliant){'COMPLIANT'}else{'NON-COMPLIANT'})" -ForegroundColor $(if ($r.IsCompliant) { 'Green' }else { 'Red' }); return $r } function Invoke-Revert { Remove-ItemProperty -Path $RegPath -Name "DeferFeatureUpdates" -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $RegPath -Name "DeferFeatureUpdatesPeriodInDays" -ErrorAction SilentlyContinue } try { if (-not(Connect-RequiredServices)) { exit 1 }; if ($Monitoring) { $r = Invoke-Monitoring; exit $(if ($r.IsCompliant) { 0 }else { 1 }) }elseif ($Remediation) { if (-not $WhatIf) { Invoke-Remediation } }elseif ($Revert) { Invoke-Revert }else { $r = Test-Compliance; exit $(if ($r.IsCompliant) { 0 }else { 1 }) } }catch { Write-Error $_; exit 1 }

Risico zonder implementatie

Risico zonder implementatie
Low: Low: No deferral = early adopter bugs (app breakage, downtime).

Management Samenvatting

Defer feature updates: 180 days (production). Stability + testing. Quality updates: 0 days (immediate). CIS recommendation. Implementatie: 2-12 uur.