id: automatic-windows-updates-disabled

info:
  name: Automatic Windows Updates Disabled
  author: princechaddha
  severity: medium
  description: Checks if automatic Windows Updates are disabled.
  impact: |
    Without regular updates, systems may miss important security patches.
  remediation: |
    Enable automatic Windows Updates to ensure timely updates for system security.
  tags: windows,updates,disabled,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name NoAutoUpdate | Select-Object -ExpandProperty NoAutoUpdate

    matchers:
      - type: word
        words:
          - "1"
# digest: 4a0a004730450221008cc4da04f1ea55e65589a1e1bb1128afa9de9420895ea356dec2058acb4f5d140220382a97ce89a7bcbba94873c8f20f746d158bdc6315e45820ca1e1ee2ebe8fdd8:922c64590222798bb761d5b6d8e72950