--- title: Using Update Compliance (Windows 10) description: Explains how to begin usihg Update Compliance. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay --- # Use Update Compliance to monitor Windows Updates This section describes how to use Update Compliance to monitor Windows Updates and troubleshoot update failures on your network. Update Compliance: - Uses telemetry gathered from user devices to form an all-up view of Windows 10 devices in your organization. - Enables you to maintain a high-level perspective on the progress and status of updates across all devices. - Provides a workflow that can be used to quickly identify which devices require attention. - Enables you to track deployment compliance targets for updates. >[!NOTE] >Information is refreshed daily so that update progress can be monitored. Changes will be displayed about 24 hours after their occurrence, so you always have a recent snapshot of your devices. In OMS, the aspects of a solution's dashboard are usually divided into blades. Blades are a slice of information, typically with a summarization tile and an enumeration of the items that makes up that data. All data is presented through queries. Perspectives are also possible, wherein a given query has a unique view designed to display custom data. The terminology of blades, tiles, and perspectives will be used in the sections that follow. Update Compliance has the following primary blades: 1. [OS Update Overview](#os-update-overview) 2. [Overall Quality Update Status](#overall-quality-update-status) 3. [Latest and Previous Security Update Status](#latest-and-previous-security-update-status) 4. [Overall Feature Update Status](#overall-feature-update-status) 5. [CB, CBB, LTSB Deployment Status](#cb-cbb-ltsb-deployment-status) 6. [Windows Defender Antivirus Assessment](#wdav-assessment) 7. [List of Queries](#list-of-queries) ## OS Update Overview The first blade of OMS Update Compliance is the General **OS Update Overview** blade: ![OS Update Overview](images/uc-11.png) This blade is divided into three sections: - Device Summary: - Needs Attention Summary - Update Status Summary The **Device Summary** displays the total number of devices in your organization. These devices have the commercial ID configured, telemetry enabled, and have sent telemetry to Microsoft within the last 28 days. The tile also shows the devices that Need Attention. The **Needs Attention Summary** summarizes devices that require action on your part. There are multiple reasons why a device might need attention, and these reasons are categorized and summarized in the tile. You can view details about devices that are categorized as Needs Attention using a table view. The following **Needs Attention** states are defined:
Needs AttentionDefinition
Out of SupportTotal number of devices that are no longer receiving servicing updates
Update failedWhen a device has reported a failure at some stage in its update deployment process, it will report that the Update Failed. You can click on this to see the full set of devices with more details about the stage at which a failure was reported, when the device reported a failure, and other data.
Missing 2+ Security UpdatesTotal number of devices that are missing two or more security updates
Update Progress StalledTotal number of devices where an update installation has been “in progress” for more than 7 days
The **Update Status Summary** summarizes your organization's devices per the Windows 10 "Windows as a Service" (WaaS) model. For more information about WaaS, see [Overview of Windows as a service](waas-overview.md). Devices are categorized as: **Current**, **Up-to-date**, and **Not up-to-date**. See the following graphical representation of this model:
![Device states](images/uc-12.png) Update Status Summary definitions:
Update StatusDefinition
Current and Up-to-dateA device that is current is on the latest and greatest Microsoft offers. It is on the very newest feature update (ex. The Windows Anniversary Update, RS1), on the very latest quality update for its servicing branch.
Up-to-dateA device that is up-to-date is on the latest quality update for its servicing option (CB, CBB, LTSB), and the device is running an OS that is supported by Microsoft.
Not up-to-dateA device does not have the latest quality update for its servicing option.
## Overall Quality Update Status **Overall Quality Update Status** is the second blade in Update Compliance. It has a donut data tile and lists the breakdown of the Up-to-date status of devices pivoted on OS version. See the following example: ![OS Quality Update Status](images/uc-13.png) The donut tile offers a summary of all devices in your organization, divided into **Up-to-date** and **Not up-to-date**. Recall that devices that are current are also up-to-date. The list view contains the breakdown of Up-to-date, Not up-to-date, and Update failed, all pivoted on OS version (e.g., 1507, 1511, 1607). Clicking on any of the rows of this list view will display the **OS Quality Update Summary Perspective** for that OS version. ## Latest and Previous Security Update Status Security updates are extremely important to your organization, so in addition to an overall view of Quality Updates, the deployment status for the latest two security updates are displayed for each supported OS build offered by Microsoft. ![Latest security update status](images/uc-14.png) For the latest security update, a doughnut chart is displayed across all OS builds with a count of installed, in progress/deferred, update failed, and unknown status relative to that update. Two table views are provided below the doughnut displaying the same breakdown for each OS build supported by Microsoft. See the following definitions:
TermDefinition
OS BuildThe OS build + Revision for the OS Version. The build + revision is a one-to-one mapping of the given security update in this context.
VersionThe OS Version corresponding to the OS build.
InstalledThe count of devices that have the given security update installed. In the case that the latest security update is not latest quality update (that is, an update has since been released but it did not contain any security fixes), then devices that are on a newer update will also be counted.

For the previous security update, a device will display as **Installed** until it has at least installed the latest security update.
In Progress or DeferredThe count of devices that are either currently in the process of installing the given security update, or are deferring the install as per their WUFB policy.

All devices in this category for Previous Security Update Status are missing 2 or more security updates, and therefore qualify as needing attention.
Update FailedThe count of devices that were **In Progress** for the given security update, but failed at some point in the process. They will no longer be shown as **In Progress or deferred** in this case, and only be counted as **Update failed**.
Status UnknownIf a device should be, in some way, progressing toward this security update, but it’s status cannot be inferred, it will count as **Status Unknown**. Devices that are not using Windows Update are the most likely devices to fall into this category.
## Overall Feature Update Status Windows 10 has two main update types: Quality and Feature updates. The third blade in Update Compliance provides the most essential data about your organization’s devices for feature updates. Microsoft has developed terms to help specify the state of a given device for how it fits into the Windows as a Service (WaaS) model. There are three update states for a device: - Current - Up-to-date - Not up-to-date See the **Update Status Summary** description under [OS Update Overview](#os-update-overview) in this guide for definitions of these terms. The Overall Feature Update Status blade focuses around whether or not your devices are considered Current. See the following example: ![Overall feature update status](images/uc-15.png) Devices are evaluated by OS Version (e.g., 1607) and the count of how many are Current, Not Current, and have Update Failures is displayed. Clicking on any of these counts will allow you to view all those devices, as well as select the **Update Deployment Status** perspective, described below.  ## Windows Defender Antivirus Assessment You'll notice some new tiles in the Overview blade which provide a summary of Windows Defender AV-related issues, highlighted in the following screenshot. ![verview blade showing a summary of key Windows Defender Antivirus issues](images/update-compliance-wdav-overview.png) The **AV Signature** chart shows the number of devices that either have up-to-date [protection updates (also known as signatures or definitions)](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus), while the **Windows Defender AV Status** tile indicates the percentage of all assessed devices that are not updated and do not have real-time protection enabled. The Windows Defender Antivirus Assessment section provides more information that lets you investigate potential issues. If you're using [Windows Defender Antivirus in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) to protect devices in your organization and have enabled [cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus), you can use this section to review the overall status of key protection features, including the number of devices that have [always-on real-time protection](/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) and up-to-date definitions. There are two blades in the Windows Defender AV Assessment section: - Protection status - Threats status ![Windows Defender Antivirus Assessment blade in Update Compliance](images/update-compliance-wdav-assessment.png) The **Protection Status** blade shows three key measurements: 1. How many devices have old or current signatures (also known as protection updates or definitions) 2. How many devices have the core Windows Defender AV always-on scanning feature enabled, called real-time protection ![Windows Defender Antivirus protection status in Update Compliance](images/update-compliance-wdav-prot-status.png) See the [Manage Windows Defender AV updates and apply baselines](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus) topic for an overview on how updates work, and further information on applying updates. The **Threats Status** blade shows the following measurements: 1. How many devices that have threats that have been remediated (removed or quarantined on the device) 2. How many devices that have threats where remediation was not successful (this may indicate a manual reboot or clean is required) ![Windows Defender Antivirus threat status in Update Compliance](images/update-compliance-wdav-threat-status.png) Devices can be in multiple states at once, as one device may have multiple threats, some of which may or may not be remediated. > [!IMPORTANT] > The data reported in Update Compliance can be delayed by up to 24 hours. See the [Customize, initiate, and review the results of Windows Defender AV scans and remediation](/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus) topic for more information on how to perform scans and other manual remediation tasks. As with other blades in Update Compliance, clicking on a specific measurement or item will open the associated query that you can use to investigate individual devices and issues, as described below. ### Investigate individual devices and threats Click on any of the status measurements to be taken to a pre-built log query that shows the impacted devices for that status. ![Sample Windows Defender AV query in Update Compliance](images/update-compliance-wdav-status-log.png) You can also find a pre-built query on the main Update Compliance screen, under the **Queries** blade, that lists devices that have not been assessed for Windows Defender AV. ![Overview blade showing a summary of key Windows Defender Antivirus issues](images/update-compliance-wdav-query-not-assessed.png) You can further filter queries by clicking any of the measurement labels for each incident, changing the values in the query filter pane, and then clicking **Apply**. ![Click the Apply button on the left pane](images/update-compliance-wdav-status-filter-apply.png) Click **+Add** at the bottom of the filter pane to open a list of filters you can apply. ![Click Add to add more filters](images/update-compliance-wdav-status-add-filter.png) You can also click the **. . .** button next to each label to instantly filter by that label or value. ![Click the elipsis icon to instantly filter by the selected label](images/update-compliance-wdav-status-filter.png) You can create your own queries by using a query string in the following format: ``` Type: