Across the notebook
Entries sharing this tag, wherever they're filed.
When Windows Update is greyed out or just won't run, check all the policy values and services that can block it, and put them back the way Windows shipped.
On Windows 10 and 11 there's no Windows Update logging to switch on. The trick is collecting it, and this script does that in one zip per machine.
How I think about patch risk now. Sort updates by blast radius, roll them out in rings, decide what "bad" looks like up front, and know your way back before you need it.
One script that reads the WSUS, scan-source and Windows Update for Business settings on a device and tells you where it's really getting updates from, with a safe reset for leftovers.
Register the Microsoft Update service through the Windows Update Agent's own COM API, so devices pick up Office and other Microsoft product updates, not just Windows.