id: windows-auto-update-disabled

info:
  name: Windows Automatic Updates Disabled
  author: boonchuan
  severity: high
  description: |
    Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
  impact: |
    Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
  remediation: |
    Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
  reference:
    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
    - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
  metadata:
    verified: false
  tags: windows,updates,patching,compliance,essential-eight,code,windows-audit

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $au = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue; if ($au -and $au.NoAutoUpdate -eq 1) { 'True' } else { 'False' }
    matchers:
      - type: word
        words:
          - "True"
# digest: 4a0a00473045022100ddcd4a1983a75eff3d9837110072c2a1665f9a37f618a2b4dc10f82234608def02203f127fd2e6fc34706eac60ae681e29f33a0a099855daa983ca0a1e41ee2aeb37:922c64590222798bb761d5b6d8e72950