Back

Microsoft Resolves Windows Update Caching Issue Affecting Driver Policies

Severity: Low (Score: 36.9)

Sources: Feeds.4Sysops, Bleepingcomputer

Published: 2026-06-04 · Updated: 2026-06-04

Keywords: windows, driver, microsoft, caching, policies, updates, update

Severity indicators: bug

Summary

On June 2, 2026, Microsoft acknowledged a misconfiguration in the Windows Update caching service that caused Windows devices to install driver updates without adhering to administrative policies. This issue temporarily dropped device enrollment information, leading to tens of thousands of devices being treated as unmanaged and allowing unauthorized driver installations. The Intune Support Team confirmed the issue and stated that the installed drivers were Microsoft approved and posed no security threat. Microsoft resolved the issue by updating the affected service cache and validating the fix by June 3. However, the exact number of affected regions or customers remains unspecified. This incident follows previous issues with Windows Server upgrades and driver installations that bypassed administrative controls. Key Points: • A misconfiguration in Windows Update caused unauthorized driver installations. • Tens of thousands of devices were affected, treated as unmanaged endpoints. • Microsoft confirmed that the installed drivers were approved and posed no security threat.

Detailed Analysis

**Impact** Tens of thousands of Windows devices globally were affected by unauthorized driver updates despite administrative policies designed to block them. This caused operational disruptions, including malfunctioning audio and video devices. The issue impacted managed endpoints across various sectors using Windows devices with enrollment in Intune or similar management services. No data breach or security threat was reported, as the installed drivers were Microsoft-approved and signed. **Technical Details** A misconfiguration in the Windows Update caching service caused temporary loss of device enrollment information, leading managed devices to be treated as unmanaged. This bypassed driver-approval controls and allowed automatic installation of driver updates without authorization. No malware, CVEs, or external attack infrastructure were involved; this was a service-side configuration error affecting the update service’s enrollment validation process. No IOCs were provided. **Recommended Response** Apply the updated Windows Update caching service patch released by Microsoft to restore correct enrollment status handling. Validate device enrollment and driver update policies in management consoles such as Intune. Monitor for unexpected driver installations and verify device functionality post-update. Continue reviewing caching service logs to detect similar enrollment drops and ensure timely remediation.

Source articles (2)

  • Microsoft blames unexpected Windows driver updates on caching issue — Bleepingcomputer · 2026-06-04
    On Wednesday, Microsoft fixed an issue that caused some Windows devices to install driver updates without notice despite policies configured to prevent auto-updates. In an admin center incident report…
  • Microsoft resolves Windows Update caching bug that bypassed driver policies — Feeds.4Sysops · 2026-06-04
    A misconfiguration in the Windows Update caching service recently caused Windows devices to ignore administrative policies designed to block automatic driver updates. This glitch resulted in the tempo…

Timeline

  • 2026-06-02 — Microsoft acknowledges driver update issue: Microsoft reported that a caching misconfiguration led to unauthorized driver installations on managed devices.
  • 2026-06-03 — Issue resolved: Microsoft updated the caching service and confirmed that the issue was resolved after validation from affected users.
  • Recent — Tens of thousands of devices affected: Windows admins reported issues with devices unexpectedly receiving BIOS and driver updates, impacting functionality.

Related entities

  • Microsoft (Company)
  • functioning.in (Domain)
Loading threat details...

Threat Not Found

The threat cluster you're looking for doesn't exist or has been removed.

Return to Feed