We build physical and virtual Windows devices from a base WIM, but the built-in AppX applications in that image sometimes contain vulnerabilities. These apps eventually update after a user logs on, but the Microsoft Store is blocked and we do not have a reliable way to trigger the updates manually. Devices that remain at the provisioning or assignment stage without a logged-on user—especially virtual machines—are still detected by vulnerability scans. Is there a supported way to update the built-in Windows apps during image creation, or deploy an update process that runs before the first user logs on?
2 Answers
This may be better handled as an asset and vulnerability-management policy issue. Devices that are still in a controlled build, staging, or provisioning state can often be excluded from production vulnerability reporting until they are assigned or released. Coordinate with the scanning and asset-management teams so these temporary devices are tracked and have a defined deadline for remediation.
You can investigate running the AppX update scan as SYSTEM during provisioning. A script or scheduled task that invokes the Windows update scan method, such as UpdateScanMethod, may trigger detection and installation before anyone signs in. Test it against your specific Windows build, application provisioning model, and Store restrictions, since built-in apps may be serviced differently depending on the OS version.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures