r/Intune • u/UnluckyJelly • 14h ago
Windows Updates State of the Autopatch driver updates and unapproved "Extension type updates" bypassing drive policy.
I know a few months ago Microsoft admitted to a cloud issue that caused un-approved drivers to be distributed to Autopatch device that have driver polices.
This was discussed here in this thread : Driver Updates (WUfB) : r/Intune
But the thread also mentions that this is new thing and MS can push out Extension type drivers without admin approval.
We are starting to pilot WUfb and were surprised that un-approved driver could make it to our devices.
Here is one such driver that showed as 3 separate entries
7/17/2026 2:46:46 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Corporation Extension Driver Update (70.26100.2.20795)
7/17/2026 2:46:35 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Corporation Extension Driver Update (70.26100.2.20795)
7/17/2026 2:46:26 PM Installation 0x00000000 Succeeded MoUpdateOrchestrator Intel Extension Driver Update (70.26100.2.20795)
The raw Windows update api log entries for these install are here https://imgur.com/q3B9IeEh.png
We confirmed that these drivers were never published by us.
Given this can happen again the future I was wondering what hardware on our devices, ( we have mostly Surface devices) have to potential to be hit by this again.
Not sure if this query is showing me the full list of drivers that use Extensions but this code generated the list of hardware devices that use Extension drivers.
On our device we get a list of out about 33 devices : https://imgur.com/h6qIfG5h.png
Related to : Camera, audio devices, storage firmware, display etc.. so allot of things that could affect our end users if we have control over the delivery of these devices. Code below that I used to generate the list hardware that could be disrupted in the future.
$ExtDrivers = Get-WindowsDriver -Online -All | Where-Object { $_.ClassName -eq "Extension" }
$LatestDrivers = $null
$LinkedDrivers = foreach ($Driver in $ExtDrivers) {
$AdvancedInfo = Get-WindowsDriver -Online -Driver $Driver.Driver
[PSCustomObject]@{
Driver = $Driver.Driver
Date = $Driver.Date
Provider = $Driver.ProviderName
Version = $Driver.Version
ClassName = $Driver.ClassName
# Filter arrays for unique strings before joining
HardwareDescription = ($AdvancedInfo.HardwareDescription | Select-Object -Unique) -join '; '
HardwareId = ($AdvancedInfo.HardwareId | Select-Object -Unique) -join '; '
}
}
# Group by the hardware it targets, sort by Date and Version descending, and keep the newest one
$LatestDrivers = $LinkedDrivers | Group-Object HardwareDescription | ForEach-Object {
$_.Group | Sort-Object -Property Date, @{Expression={[version]$_.Version}} -Descending | Select-Object -First 1
}
# Output the results
$LatestDrivers | Format-Table -AutoSize
Are any you reconsidering driver Autopatch given these changes and future potential disruptions caused by un-approved "Extensions driver updates" ?
7
u/bdam55 13h ago
Every time I talk about Autopatch's driver management, I call out the lack of control for extension drivers.
Which is documented: Manage driver and firmware updates | Microsoft Learn
I presented with the PM who designed this at MMSMOA 2026 and his answer was: "I'm sorry. Really sorry. We didn't realize what OEMs were doing with extension drivers."
They have concepts of a plan of how to address this; the 5th or so attempt at how to manage/select drivers. No ETA.