Steps

1) Download the OOB Update (.msu)

1. Go to the Microsoft Update Catalog.
2. Locate and download the required OOB update .msu for your OS (Windows 10/11, Server variants).
   • Save to a working folder (e.g., C:\OOB\Package).

2. Prepare the .msu File as a Win32 App (.intunewin)

You must package the .msu using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe).

Steps:

1. Download the Win32 Content Prep Tool from Microsoft (IntuneWinAppUtil.exe).
2. 
3. Place the .msu (and optionally a PowerShell install script) in a source folder (e.g., C:\OOB\Source).
4. Run the tool with explicit paths, for example:

IntuneWinAppUtil.exe -c "C:\OOB\Source" -s "OOBInstall.ps1" -o "C:\OOB\Output"

Where:

• -c = source folder containing your files (the .msu and/or script)
• -s = setup file (the entry point the app will run; use your script or the .msu)
• -o = output folder where the .intunewin package will be created

If you omit parameters, the tool will interactively prompt for them.

3) (Recommended) Create a PowerShell Install Script

Using a script gives you better control (waiting, logging, return codes).

Script example: OOBInstall.ps1:

# OOBInstall.ps1

param(

    [string]$MsuName = "Windows10.0-KBXXXXXXX-x64.msu" # Replace with the real KB file

)

# Ensure the script runs from its directory

Set-Location -Path (Split-Path -Path $PSCommandPath -Parent)

# Install the MSU silently and wait for completion

$arguments = "$MsuName /quiet /norestart"

$process = Start-Process -FilePath "wusa.exe" -ArgumentList $arguments -Wait -PassThru

# WUSA commonly returns 0 (success), 3010 (success with restart required)

if ($process.ExitCode -in 0, 3010) {

    exit 0

} else {

    Write-Error "WUSA failed with exit code $($process.ExitCode)"

    exit $process.ExitCode

}

Why Start-Process -Wait? It ensures Intune properly tracks completion before evaluating detection rules.

Package this script alongside the .msu, and make it your setup file in IntuneWinAppUtil.exe.

Create the Win32 App in Intune

1. Sign in to Intune admin center.
2. Go to Apps → All apps → Add → App type: Windows app (Win32).
3. Select app package file and upload the .intunewin created earlier.
4. App information: Fill Name, Description, Publisher, Category, etc.

Program → Install command (choose one):

• If using the script (recommended):
• powershell.exe -ExecutionPolicy Bypass -File .\OOBInstall.ps1
• Direct MSU (no script):
• wusa.exe .\Windows10.0-KBXXXXXXX-x64.msu /quiet /norestart

Program → Uninstall command: You’ll need the PackageName. You can discover it with:

dism /online /get-packages | findstr KBXXXXXXX

Then remove it:

dism /online /remove-package /PackageName:<ExactPackageName> /Quiet /NoRestart

Note: Not all OOB updates are designed to be easily removable. Validate the rollback plan in a pilot first.

Requirements:

OS architecture/version as needed.

-o

5) Set Detection Rules

Choose one detection approach to confirm the update is installed.

Option A — PowerShell: Check HotFix

# Returns exit code 0 if found (installed), non-zero otherwise

$kb = "KBXXXXXXX"   # Replace with the actual KB

if (Get-HotFix -Id $kb -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Option B — Registry (CBS Packages)

• Path pattern:
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\<PackageID>
• The <PackageID> typically starts with Package_for_KBXXXXXXX~...
• CurrentState indicates status; installed is commonly 112.

For example, detect existence of the package key with CurrentState = 112.

Note: Exact package names/values vary per KB and OS build. Confirm in your pilot devices.

6) Assign the App to Device Groups

1. Go to Assignments.
2. Target:  
   • Pilot group first (recommended), then
   • All affected devices.
3. Use Required for automatic installation.

Consider maintenance windows and restart behavior. OOB updates often require a reboot to complete; whether you allow immediate restart depends on your change policy.

7) Monitor Deployment

• Intune Admin Center → Apps → (Your app) → Monitor
  • Track Install status, Failures, and Pending.
  • Drill into error codes to troubleshoot (wusa/dism returns, detection rule mismatches, content distribution).

Once deployment completes and your validation passes, resume Autopatch updates as normal.