Windows Monthly Updates Explained: LCU, SSU, Patch Tuesday and What Actually Gets Installed

Every month, Windows ships updates. Your users see a notification, click Install, and assume you understand exactly what just happened. In most environments, that assumption is wrong — and when something breaks after Patch Tuesday, not knowing the difference between an LCU and a preview release means you are debugging blind.

This post breaks down the Windows monthly update model precisely — what each release type is, when it ships, what it contains, and how to control it in Intune and Windows Update for Business.

The Windows monthly update calendar

Microsoft ships Windows quality updates on a predictable monthly cadence built around two fixed weeks:

Update types demystified

What "cumulative" actually means in practice

Every LCU contains all fixes from all previous LCUs for that Windows version and servicing branch. This means:

• A device that missed the last 3 months of patches only needs to install the current month's LCU — one update catches up everything.
• There is no dependency chain of old patches to apply first. The LCU is self-contained.
• If a fix introduced in a prior month is later revised, the current LCU contains the revised version — not both.

How to control updates in Intune

Windows Update for Business — Update rings

A typical three-ring model:

# Get the last 10 installed Windows updates with KB numbers and install dates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 |
    Select-Object HotFixID, Description, InstalledOn, InstalledBy |
    Format-Table -AutoSize

HotFixID   Description         InstalledOn          InstalledBy
--------   -----------         -----------          -----------
KB5040529  Security Update     08/07/2026 00:00:00  NT AUTHORITY\SYSTEM
KB5039302  Security Update     11/06/2026 00:00:00  NT AUTHORITY\SYSTEM
KB5036893  Security Update     09/04/2026 00:00:00  NT AUTHORITY\SYSTEM

Check the current Windows Update deferral policy via registry

# Read Windows Update for Business deferral settings from registry
$wufb = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ErrorAction SilentlyContinue

if ($wufb) {
    [PSCustomObject]@{
        QualityDeferralDays   = $wufb.DeferQualityUpdatesPeriodInDays
        FeatureDeferralDays   = $wufb.DeferFeatureUpdatesPeriodInDays
        PauseQualityUpdates   = $wufb.PauseQualityUpdates
        ManageUpdatesByRing   = $wufb.BranchReadinessLevel
        WUServer              = $wufb.WUServer
    } | Format-List
} else {
    Write-Host "No WUfB policy found — device using default Windows Update settings" -ForegroundColor Yellow
}

CSP and Group Policy coverage

Intune OMA-URI (CSP) — quality update deferral

Group Policy equivalent

Troubleshooting: why a device is not installing the latest update

Check the Windows Update log on the device. The log is written in a binary ETL format — use this PowerShell command to decode it:

# Decode the binary ETL update log to a readable text file
Get-WindowsUpdateLog -LogPath "C:\Logs\Intune\WindowsUpdate.log"

# Then search for failures
Select-String -Path "C:\Logs\Intune\WindowsUpdate.log" -Pattern "FAILED|Error|0x8" |
    Select-Object -Last 20 |
    Format-List LineNumber, Line

References

• Understanding Windows monthly updates: Servicing explained — Windows IT Pro Blog
• Windows update release cycle — Microsoft Learn
• Manage Windows updates using Windows Update for Business — Microsoft Learn
• Manage Windows 10/11 software updates in Intune — Microsoft Learn
• Windows message centre — Microsoft Learn