KQL Search

Query Details

MDE - Windows 11 - Issues might occur with media which installs the October or November update

MDE Windows11 Issues OS Build 26100 2033

Query

DeviceTvmSoftwareVulnerabilities
| where SoftwareVendor == 'microsoft'
| where SoftwareName == 'windows_11'
| where isnotempty(RecommendedSecurityUpdate)
| distinct DeviceId, RecommendedSecurityUpdate, RecommendedSecurityUpdateId, SoftwareName
| join kind=leftouter (
DeviceInfo
    | where isnotempty(OSPlatform)
    | where OnboardingStatus == 'Onboarded'
    | where isnotempty(OSVersionInfo)
        | summarize arg_max(Timestamp,*) by DeviceId
        | where OSPlatform == @"Windows11"
        | where OSVersionInfo == @"24H2"
        | where OSBuild == "26100"
        | where OsBuildRevision in ("2033","2161","2314","2454","863","1742")
           on $left.DeviceId == $right.DeviceId
| summarize MissingKBs = make_set(RecommendedSecurityUpdate) by DeviceName
| extend TotalMissingKB = array_length(MissingKBs)

About this query

Explanation

This query is designed to identify Windows 11 devices that might have issues receiving further security updates due to the installation of the October or November 2024 updates using specific media. Here's a simplified breakdown of the query:

  1. Purpose: The query aims to find devices running Windows 11, version 24H2, that might be stuck in a state where they can't receive new security updates. This issue arises if the installation media included updates released between October 8, 2024, and November 12, 2024.
  2. Key Criteria:
    • The devices must have Windows 11 with OS Build 26100. - The OS Build Revisions of interest are 2033, 2161, 2314, 2454, 863, and 1742.
  3. Query Components:

    • Microsoft Defender XDR Query:

      • Searches for devices with vulnerabilities related to Windows 11 software.
      • Filters devices that have been onboarded and match the specified OS build and revision numbers.
      • Lists missing security updates for these devices.

    • Log Analytics Query:

      • Identifies devices running Windows with the specified OS version and build numbers.

    • Windows Update for Business Report:

      • Lists devices with specific OS revision numbers, providing details like device ID, name, and OS version.

Overall, the query helps IT administrators identify and address potential update issues on Windows 11 devices, ensuring they remain secure and up-to-date.

Details

Alex Verboon profile picture

Alex Verboon

Released: April 2, 2025

Tables

DeviceTvmSoftwareVulnerabilitiesDeviceInfoIntuneDevicesUCClient

Keywords

DevicesIntuneUserWindowsMicrosoftSecurityUpdate

Operators

`|``where``==``isnotempty``distinct``join``kind=leftouter``summarize``arg_max``by``in``on``extend``make_set``array_length``project``contains`

Actions

GitHub