Why device shows missing patch that Windows Update isn't offering

Find out why your device shows a missing patch that Windows Update isn't offering.

Sometimes Redamp.io will flag a device as missing a patch that Microsoft has already released, even though Windows Update on that device shows nothing to install. This is usually not a broken agent or a missed check-in. In most cases Windows Update is deliberately not offering the patch yet, and forcing it can do more harm than waiting. This article explains why it happens and what to do, depending on the cause.

Why this happens

There are five common causes, roughly in order of likelihood:

  1. Safeguard hold (compatibility hold). Microsoft has detected a known issue with a specific driver, application, or hardware combination that would cause the update to fail or roll back on this exact device. Microsoft deliberately withholds the update until a fix ships, and Windows Update shows a "this update is on its way, but not ready for your device" message instead of a download option.
  2. Throttled rollout. Even with no compatibility issue, Microsoft rolls patches out gradually across the install base. A device may simply not be in the current wave yet.
  3. Policy-based deferral or pause. Windows Update for Business deferral settings, or a manual "pause updates" (up to 35 days), intentionally delay installation for testing or stability reasons.
  4. Update server not synced or approved. If the device points to an internal update server (WSUS/ConfigMgr) via Group Policy, the patch won't be offered until that server has synced it and an admin has approved it, regardless of when Microsoft released it publicly.

How to tell which one applies

Start on the device itself:

If you manage devices through Intune, Windows Update for Business reports lists active safeguard holds by an 8-digit ID, which you can look up on the Windows release health "Known issues" page for the relevant release to see what the underlying problem is.

If devices are on WSUS/ConfigMgr, check whether the KB is approved and synced for the relevant target group; approval date, not release date, determines whether it's offered.

What to do

If it's a safeguard hold: Wait. Microsoft's own guidance is not to force the update until the hold is released, since the hold exists specifically to prevent a bad outcome, rollback, data loss, or driver breakage, on that device's exact configuration. Forcing it manually reintroduces the risk the hold was put there to avoid.

If it's throttled rollout with no known issue: It's generally safe to install it yourself. Download the specific KB from the Microsoft Update Catalog and install it directly with wusa.exe /quiet /norestart (or DISM /Online /Add-Package for cumulative update packages), bypassing the standard offer logic. For a whole fleet, push it as a Win32 app deployment in Intune or ConfigMgr instead of waiting on the normal Windows Update pipeline.

If it's a policy deferral or pause: Confirm this is intentional. If so, no action is needed; the device isn't actually at risk, it's just on a deliberate delay.

If the update server hasn't synced or approved it: Approve it on WSUS/ConfigMgr, or trigger a manual sync.

If admins decide to override a safeguard hold anyway (for example, after confirming the known issue doesn't apply to their hardware): this can be done via the Update/DisableWUfBSafeguards CSP setting in Intune, or the "Disable safeguards for Feature Updates" Group Policy. Microsoft recommends this only for validation in a controlled IT environment, not as a routine fix, and it should be reverted afterward.