# Configuration guide: Windows OS compliance

{% hint style="warning" %}
The configuration options on this page are only accessible to [administrators](https://docs.nexthink.com/platform/user-guide/administration/account-management/roles#roles-administration).

Refer to the [Usage guide: Windows OS compliance](https://docs.nexthink.com/platform/library-packs/operating-systems/operating-systems-stability-security-and-compliance/operating-systems-stability-security-and-compliance-usage-guide) to use library content as a standard user.
{% endhint %}

This library pack will help you monitor and manage various operating systems to ensure their stability, compliance, and performance. This page will guide you through the structure of the content.

## **Included content and dependencies** <a href="#documentation-contentanddependencies" id="documentation-contentanddependencies"></a>

This library pack contains the following content and dependencies:

| Type                                                                                                                      | Name                                 | Description                                                                                                                                                  | Dependencies                                                       |
| ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ |
| [Live dashboards](https://docs.nexthink.com/platform/user-guide/live-dashboards)                                          | Windows OS compliance                | Helps to monitor and manage various Windows operating system versions to ensure their stability, compliance, and performance                                 | N/A                                                                |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Get BitLocker information            | Returns basic information on BitLocker protection status.                                                                                                    | <ul><li>Required to populate specific dashboard widgets.</li></ul> |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Test pending reboot                  | Checks if the device is waiting to reboot for an update.                                                                                                     | <ul><li>Required to populate specific dashboard widgets.</li></ul> |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Install Windows update               | Installs a ‘.msu’ patch on Windows devices.                                                                                                                  | N/A                                                                |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Invoke Windows update                | Restarts Windows Update and BITS services on Windows devices and forces the device to check for updates.                                                     | N/A                                                                |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Get Windows Feature update diagnosis | Executes Microsoft tool SetupDiag.exe, that process Windows Feature update log files and returns a list of possible failure reasons or upgrade confirmation. | N/A                                                                |
| [Remote actions](https://docs.nexthink.com/platform/user-guide/remote-actions)                                            | Enable BitLocker Encryption          | Enables BitLocker encryption on the device's system drive.                                                                                                   | N/A                                                                |
| [Custom fields](https://docs.nexthink.com/platform/user-guide/administration/content-management/custom-fields-management) | OS targeted quality update version   | Defines the target quality update versions of Windows operating systems.                                                                                     | <ul><li>Required to populate specific dashboard widgets.</li></ul> |
| [Custom fields](https://docs.nexthink.com/platform/user-guide/administration/content-management/custom-fields-management) | OS supported version                 | Determines which Windows operating system versions, editions, and builds are supported.                                                                      | <ul><li>Required to populate specific dashboard widgets.</li></ul> |
| [Custom fields](https://docs.nexthink.com/platform/user-guide/administration/content-management/custom-fields-management) | OS targeted feature update version   | Defines the target feature update versions of Windows operating systems. Typically, this custom field requires version updates every month.                  | <ul><li>Required to populate specific dashboard widgets.</li></ul> |

## **Configuring Windows OS Compliance** <a href="#documentation-configurationguide" id="documentation-configurationguide"></a>

{% hint style="info" %}
Adapt these suggested configuration steps to edit and customize content according to your organizational needs.
{% endhint %}

To effectively use this library pack, the content must be installed and configured appropriately. Below are some suggested steps to install and configure the content properly before use.

Follow these steps to install and configure content:

* Before configuration - Install library pack content from [Nexthink Library](https://docs.nexthink.com/platform/user-guide/nexthink-library)
* [Step 1 - Configure remote actions](#step-1-configure-remote-actions)
* [Step 2 - Configure custom fields](#step-2-configure-custom-fields)

### **Step 1 - Configure remote actions**

Navigate to the [manage remote action](https://docs.nexthink.com/platform/user-guide/remote-actions/managing-remote-actions) administration page to review and edit your remote actions.

Nexthink recommends the following configurations for these remote actions:

<table><thead><tr><th>Name</th><th>Trigger</th><th width="241">Schedule query</th><th>Parameters to edit</th></tr></thead><tbody><tr><td>Get BitLocker information</td><td>Scheduled, daily</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name != "*server*"
</code></pre></td><td></td></tr><tr><td>Test pending reboot</td><td>Scheduled, daily</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name != "*server*"
</code></pre></td><td></td></tr><tr><td>Install Windows update</td><td>Manual, can be triggered on multiple devices</td><td></td><td><ul><li>Provide URL or UNC path to the update (.msu) file</li></ul></td></tr><tr><td>Invoke Windows update</td><td>Manual, can be triggered on multiple devices</td><td></td><td></td></tr><tr><td>Get Windows Feature update diagnosis</td><td>Manual, can be triggered on multiple devices</td><td></td><td><ul><li>Configure the absolute path to the location of SetupDiag.exe tool on the target device. For example "C:\temp\SetupDiag.exe"</li></ul></td></tr><tr><td>Enable BitLocker Encryption</td><td>Manual, can be triggered on multiple devices</td><td></td><td><ul><li>Enable or disable the 'Enforce AD backup' setting.</li><li>Define the drive encryption type used by BitLocker.</li><li>Define the encryption method used by BitLocker: 'Aes128', 'Aes256', 'XtsAes128' or 'XtsAes256'</li></ul></td></tr></tbody></table>

### **Step 2 - Configure custom fields**

Navigate to the [manage custom fields ](https://docs.nexthink.com/platform/user-guide/administration/content-management/custom-fields-management)administration page to review and edit your custom fields.

{% hint style="info" %}
Operating system versions in the custom fields below are subject to change due to regular patches released by vendors and Apple and Microsoft support policies.

Typically, these versions need to be updated in the custom fields once a month to ensure you have the most current patch versions.
{% endhint %}

Nexthink recommends the following configurations for these custom fields:

<table><thead><tr><th width="140">Name</th><th width="161">NQL ID</th><th width="154">Rule name</th><th width="114">Object</th><th>NQL query</th></tr></thead><tbody><tr><td>OS targeted quality update version</td><td>os_targeted_quality_update_version</td><td>windows_10_quality_update</td><td>device</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name == "*windows 10*"
3 | where (operating_system.name == "*22h2*" and operating_system.build >= v19045.4717) or (operating_system.name == "*21h2*" and operating_system.build >= v19044.4651)
</code></pre></td></tr><tr><td></td><td></td><td>windows_11_quality_update</td><td>device</td><td><pre><code>1 devices
2 | where operating_system.platform == windows and operating_system.name == "*windows 11*"
3 | where (operating_system.name == "*22H2*" and operating_system.build >= v22621.3958) or (operating_system.name == "*23H2*" and operating_system.build >= v22631.3958)
</code></pre></td></tr><tr><td>OS targeted feature update version</td><td>os_targeted_feature_update_version</td><td>windows_10_feature_update</td><td>device</td><td><pre data-title="Code"><code><strong>1 devices
</strong>2 | where operating_system.platform == windows and operating_system.name == "*windows 10*"
3 | where (operating_system.name =="Windows 10*22H2*" or (operating_system.name =="Windows 10*21H2*" and device.operating_system.name == "*ltsc*"))
</code></pre></td></tr><tr><td></td><td></td><td>windows_11_feature_update</td><td>device</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name == "*windows 11*"
3 | where operating_system.name == "*23H2*"
</code></pre></td></tr><tr><td>OS supported version</td><td>os_supported_version</td><td>windows_unsupported_version</td><td>device</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name != "*server*"
<strong>3 | where (operating_system.name !in ["*enterprise*", "*education*", "*ltsc*", "*ltsb*"] and operating_system.name in ["*windows 11*"] and operating_system.build &#x3C; v22621.521) or (operating_system.name !in ["*enterprise*", "*education*", "*ltsc*", "*ltsb*"] and operating_system.build &#x3C; v19045.0) or (operating_system.name !in ["*ltsc*", "*ltsb*"] and operating_system.name in ["*pro*", "*pro*"] and operating_system.build &#x3C; v19045.2130) or (operating_system.name in ["*enterprise*", "*education*"] and operating_system.name !in [ "*ltsc*", "*ltsb*"] and operating_system.build &#x3C; v19044.0) or (operating_system.name in [ "*ltsc*", "*ltsb*"] and operating_system.build &#x3C; v19044.0) or operating_system.name == "*Windows 7*" or operating_system.name == "*Windows 8*" or operating_system.build &#x3C; v7601.0
</strong></code></pre></td></tr><tr><td></td><td></td><td>windows_supported_version</td><td>device</td><td><pre data-title="Code"><code>1 devices
2 | where operating_system.platform == windows and operating_system.name != "*server*"
<strong>3 | where (operating_system.name !in ["*ltsc*", "*ltsb*"] and operating_system.name in ["*enterprise*", "*education*"] and operating_system.name == "*windows 11*" and operating_system.build > v22000.194) or (operating_system.name !in ["*ltsc*", "*ltsb*", "*enterprise*", "*education*"] and operating_system.name == "*windows 11*" and operating_system.build > v22621.521) or (operating_system.name !in ["*ltsc*", "*ltsb*"] and operating_system.name == "*windows 10*" and operating_system.name in ["*enterprise*", "*education*"] and operating_system.build > v19044.1288) or (operating_system.name !in ["*ltsc*", "*ltsb*"] and operating_system.name in ["*pro*", "*pro*"] and operating_system.name == "windows 10*" and operating_system.build > v19045.0) or (operating_system.name in ["*ltsc*", "*ltsb*"] and operating_system.build > v19044.0)
</strong></code></pre></td></tr></tbody></table>

***

RELATED TOPICS

* Overview page: [Windows OS Compliance](https://docs.nexthink.com/platform/library-packs/operating-systems/operating-systems-stability-security-and-compliance)
* [Usage guide template: Windows OS Compliance](https://docs.nexthink.com/platform/library-packs/operating-systems/operating-systems-stability-security-and-compliance/operating-systems-stability-security-and-compliance-usage-guide)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/library-packs/operating-systems/operating-systems-stability-security-and-compliance/operating-systems-stability-security-and-compliance-configuration-guide.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.