How to Configure Maintenance Windows in Microsoft Intune for Update Control

Start by logging into the Microsoft Intune admin center and creating a new configuration policy specifically for maintenance windows.

Open your browser and navigate to endpoint.microsoft.com. Sign in with your admin credentials. Once logged in, navigate to Devices > Manage devices > Configuration. Click Create and select New policy.

In the policy creation wizard, select:

• Platform: Windows 10 and later
• Profile type: Settings catalog

Click Create to proceed to the next step.

Now configure the basic policy details and locate the maintenance window settings within the Settings catalog.

In the Basics tab, provide the following information:

• Name: Maintenance Window - Updates
• Description: Schedules Windows updates during off-hours to prevent business disruption

Click Next to proceed to the Configuration settings tab. In the Configuration settings section, use the search bar and type Maintenance Window. The search will return settings under the Windows Update category.

Select the following maintenance window settings to add them to your policy:

• Maintenance Window Enabled
• Maintenance Window Start Date Time
• Maintenance Window Duration
• Maintenance Window Recurrence Type
• Maintenance Window Governed Actions

Configure the specific timing and duration for your maintenance window to align with your organization's non-business hours.

Set the following values for your maintenance window settings:

Maintenance Window Enabled: Set to Enabled

Maintenance Window Start Date Time: Configure the start time using ISO 8601 format. For example, to start at 10 PM on April 28, 2026, enter:

2026-04-28T22:00:00.000Z

Maintenance Window Duration: Set the duration in minutes. For a 5-hour window, enter 300 minutes.

Maintenance Window Recurrence Type: Choose from the following options:

• 1 = No repeat (one-time)
• 2 = Daily
• 3 = Weekly
• 4 = Monthly

For most organizations, weekly recurrence (3) works best for regular maintenance schedules.

Maintenance Window Governed Actions: This controls what actions are allowed during the window. Use bitmask values:

• Install updates: 1
• Restart device: 2
• Both install and restart: 3

Target your maintenance window policy to the appropriate device groups to ensure it applies to the correct machines in your organization.

Click Next to proceed to the Assignments tab. Here you'll specify which devices or users should receive this maintenance window configuration.

Under Included groups, click Add groups and select the appropriate device groups. Common targeting strategies include:

• All Windows devices: For organization-wide maintenance windows
• Department-specific groups: For different schedules per department
• Device type groups: Separate schedules for laptops vs. desktops

If you need to exclude certain critical devices, use the Excluded groups section to add groups containing servers or always-on workstations.

Click Next to proceed to the review screen.

Complete the policy creation process by reviewing all settings and deploying the configuration to your selected devices.

On the Review + create tab, carefully review all your configuration settings:

• Policy name and description
• Maintenance window schedule and duration
• Recurrence settings
• Assigned device groups

If everything looks correct, click Create to deploy the policy. The policy will begin applying to targeted devices within the next sync cycle (typically 8 hours for device configuration policies, but can be faster).

After creation, you can monitor the policy deployment by navigating to Devices > Monitor > Device configuration and selecting your maintenance window policy.

For organizations requiring more granular control over maintenance windows, create a custom OMA-URI policy to access advanced Update CSP settings not available in the Settings catalog UI.

Navigate to Devices > Configuration > Create > New policy. Select:

• Platform: Windows 10 and later
• Profile type: Custom

In the custom profile, click Add to create OMA-URI settings. Configure the following advanced settings:

This approach provides more precise control over scheduling that may not be available through the standard UI.

Ensure your maintenance windows work effectively with your existing Windows Update ring configurations for comprehensive update management.

Navigate to Devices > Windows updates > Update rings for Windows 10 and later. Select your existing update ring or create a new one if needed.

Configure the following settings to work optimally with maintenance windows:

Quality update deferral period: Set to 0-7 days to allow updates during maintenance windows

Feature update deferral period: Configure based on your testing requirements (typically 30-180 days)

Installation behavior: Set to "Auto install and restart at maintenance time"

Restart checks: Enable "Skip all restart checks"

{
  "qualityUpdatesDeferralPeriodInDays": 3,
  "featureUpdatesDeferralPeriodInDays": 60,
  "installationBehavior": "autoInstallAtMaintenanceTime",
  "restartChecks": "skip"
}

Assign the update ring to the same device groups as your maintenance window policy to ensure consistent behavior.

Establish monitoring procedures to ensure maintenance windows are working correctly and troubleshoot common issues that may arise.

Monitor maintenance window effectiveness through multiple channels:

Intune Reporting: Navigate to Reports > Windows updates to view update installation patterns and compliance status.

Device-level verification: On target devices, check the following:

# Check maintenance window registry settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" -Name "MaintenanceWindow*"

# View Windows Update log for maintenance window activity
Get-WinEvent -LogName "Microsoft-Windows-WindowsUpdateClient/Operational" | Where-Object {$_.Message -like "*maintenance*"}

Common troubleshooting scenarios:

• Updates installing outside window: Check for conflicting active hours settings or multiple maintenance window policies
• Devices not receiving policy: Verify device enrollment status and group membership
• Maintenance window not enforced: Confirm Windows 11 24H2+ and feature flag availability

For devices powered off during maintenance windows, configure deadline enforcement in your update rings to ensure updates eventually install.