Windows Updates Keep Failing and Rolling Back on Intune-Enrolled Dell Devices

Do the affected clients have application-control software such as ThreatLocker installed? We saw a similar combination involving Dell hardware, ThreatLocker, and a hotpatch. It may not be an Intune-only problem—the security agent could be blocking a driver or update component during the reboot, which then causes Windows to roll back.

NinjaOne will effectively lose control when another management platform is configuring Windows Update. It does not necessarily have to be Intune—any competing update policy can override or conflict with NinjaOne. I’d compare the Windows Update and hotpatch policies on the affected machines and confirm which service is actually approving and installing the update.

We’ve run into something similar, including a few machines that ended up in repeated blue-screen loops. The pattern looked like a hotpatch being applied even though the normal patching tool had not approved it, so checking Intune’s global hotpatch settings and removing conflicting Windows Update policies was where we focused first.

The July update ending in 650 was reported as incompatible with the Intel Innovation Platform Framework driver on some Dell devices. Microsoft later addressed the issue with an out-of-band update, KB5121767. It may be worth reassessing the rejected-update policy and making sure the Dell systems have the replacement update and current Intel IPF drivers before continuing to block the original package.