We build physical and virtual Windows devices from a base WIM, but that image often contains vulnerabilities in the bundled AppX applications. The built-in apps eventually update after a user signs in, but the Microsoft Store is blocked and we currently have no reliable way to trigger those updates. Unassigned devices—especially VMs and occasionally laptops—may remain at the logon screen long enough to appear in vulnerability reports. Is there a supported way to update the built-in apps during image creation, or to trigger the updates through a system-level deployment before the first user logs on?
2 Answers
For the technical route, try running the Windows app update scan from a scheduled task or deployment script under the SYSTEM account. The UpdateScanMethod mechanism can still trigger an update check without an interactive user session, so it may be suitable for the build or provisioning phase. Test it against your Windows version and application-management policies first, since Store restrictions and servicing configuration can affect the result.
A practical fix may be to change the vulnerability-management process rather than modify the image. Devices still in provisioning, sitting in a workbench, or waiting for assignment can often be excluded from production vulnerability reporting until they are placed into service. Coordinate with the vulnerability-management and asset-management teams so those devices are tracked separately and scanned according to their deployment state.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures