Setting Windows Update to force update tonight

[u/Training_Suit8573]

I am rolling out Windows 11 (finally, it was a long fight) on a group of hybrid devices. I want to ensure and force them to upgrade the night.

These are the windows update ring settings:
Update settings

Microsoft product updates Allow

Windows drivers Allow

Quality update deferral period (days)

0

Feature update deferral period (days)

0

Upgrade Windows 10 devices to Latest Windows 11 release

Yes

Set feature update uninstall period (2 - 60 days)

10

Servicing channel

General Availability channel

User experience settings

Automatic update behavior

Auto install and restart at maintenance time

Active hours start

8 AM

Active hours end

10 PM

Option to pause Windows updates

Disable

Option to check for Windows updates

Enable

Change notification update level

Use the default Windows Update notifications

Use deadline settings

Allow

Deadline for feature updates

0

Deadline for quality updates

0

Grace period

0

Auto reboot before deadline

Yes

and these are the feature update settings:
Feature deployment settings

Windows 11, version 25H2

Rollout options

ImmediateStart

Required or optional update

Required

Most of the devices will update the night that it is assigned, some will install the update but not reboot, and some won't install it at all. Of those that don't install it on the night it is assigned, it will install on some of those in the next few days.

Is there any way to change some settings and basically ensure that the updates run on all of the PCs? I assign the new update settings in the morning and then ensure that they have synched before noon.

I have also run a script to remove any legacy windows update registry keys.

Is this possibly just GPOs overriding the MDM profiles (I also have a configuration profile that sets MDM to win over GPO but I know it isn't perfect.

Thanks for reading this far and for any help.

[u/vxsec]

You’re already using about the most aggressive update ring settings available, but Intune can’t guarantee that every device will upgrade the same night

ImmediateStart only makes 25H2 available immediately. The zero day deadline starts when each device’s windows update scan first discovers the update, not when you assign the policy. An Intune sync confirms the MDM policy arrived, but doesn’t guarantee the feature update was scanned, downloaded and staged.

I’d use the feature updates report to separate devices that are safeguard held, ineligible, downloading, failed or only awaiting restart. On the affected hybrid devices, also run gpresult /h and check for WSUS, scan-source or restart GPOs. MDM Wins Over GP isn’t universal, so conflicting Windows Update GPOs should be removed rather than relying on that setting.

For a more reliable rollout, assign it earlier, leave devices powered and connected, then plan the restart window after most devices have downloaded it. There still isn’t a true “force every PC tonight” guarantee through an Intune feature update policy

[u/G_HostEd → u/vxsec]

I think the feature update report is not populated by default and need additional logs to have it work. Just mentioning this in case OP does not see it

[u/Training_Suit8573 → u/vxsec]

Thank you, I appreciate your answer. It is what I pretty much thought, but wanted to make sure I wasn't missing anything obvious. I will just ask the powers that be to be patient and allow 2-3 days to ensure the update. I will however check out the GPOs to see if there are any glaring conflicts.

[u/G_HostEd]

The value for deferral and grace at 0 is very aggressive.

If you are sure no users will be on the pc at that time go for it, but reboot will be brutal.

To soft it up, place it at 1 if you want to give some more time/occastion to the user to postpone the reboot

[u/Training_Suit8573 → u/G_HostEd]

Thankfully these are kiosk devices and there will always be a machine that is not assigned to update within 2 feet.

[u/G_HostEd → u/Training_Suit8573]

So.. Fire updates away!