Direct answer
Compare the device's Windows edition, version and build with Microsoft's applicable release and lifecycle information, then review update status and pending restarts. A low count of installed hotfixes or an old last-patch date is a signal to investigate, not a complete missing-update inventory.
Record the exact operating system
Record the Windows edition, feature version and OS build from Settings or the winver dialog, together with the device name and assessment date. Editions and servicing channels have different support timelines, so compare like with like.
For Windows 11, Microsoft's release information lists current builds and end-of-update dates by edition and servicing option. Check the live page rather than assuming a date from an old report is still current.
Reference: Microsoft: Windows 11 release information.
Compare version and update history
Open Settings, Windows Update and Update history. Review recent quality updates, failures, pending installations and restart requirements; compare the recorded build with the release information appropriate to the installed version and approved update policy.
Windows 11 monthly security updates are cumulative. Therefore, simply counting hotfix entries or treating an old installation date as a list of missing patches can be misleading.
Reference: Microsoft: Windows 11 release information.
Investigate before changing the device
A missing update can reflect a paused deployment, a failed installation, a pending restart, an unsupported release, connectivity or an organization-managed maintenance window. Record the precise error or update identifier and consult the device's update management system before retrying.
Coordinate maintenance for business-critical systems: installation and restart can interrupt work. Obtain the owner's approval and follow the established deployment and rollback procedure.
- Record edition, version, build and assessment time.
- Check failed or pending updates and whether a restart is required.
- Compare the effective state with the organization's approved deployment timeline.
Retest after deployment
After the approved update and restart, check Windows Update and the OS build again. Record the new build, completion time and any remaining failure; repeat the posture scan to refresh the snapshot. Keep unsupported-version remediation separate from a single monthly update installation.
Assessment limits
Update history and a scanner's last-patch or hotfix count do not provide a complete inventory of applicable security updates. Applicability, servicing channel, managed deployment state and application updates require separate review.
Frequently asked questions
Does a low hotfix count prove Windows is unpatched?
No. It can reflect inventory method or cumulative servicing. Check the OS build, applicable release information and update management status.
Is a recent update enough to prove the version is supported?
No. Compare the specific edition, feature version and servicing option with Microsoft's current lifecycle and release information.
Why check again after a restart?
An update may remain pending until a restart completes. Rechecking the build and update status confirms the state observed after the change.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.