MediumOS hardeningBLWK-WIN-010

Windows hasn't installed an update in ‹last update days› days

What this means

The newest installed Windows update is ‹last update days› days old. Microsoft releases security fixes every month, so this computer is likely missing fixes for vulnerabilities that are already public.

How to fix it

Open Settings → Windows Update → Check for updates and install what's offered. If updates keep failing or are paused, check Pause updates and any update policy set by your organisation.

Check it yourself

Run a scan and look for BLWK-WIN-010 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads windows_security and reports this check when:

last_update_days_known == true and last_update_days > 60

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1190

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001