Windows 10 22H2 Consumer ESU: “Missing Important Security and Quality Fixes” persists despite KB5120249 installed and ESU enrollment confirmed

Question

Windows 10 22H2 Consumer ESU: “Missing Important Security and Quality Fixes” persists despite KB5120249 installed and ESU enrollment confirmed

Rajat Pandey 0

Windows10_ESU_RedWarning_Public_SOP_Evidence_Pack.pdf Hello Microsoft Q&A community and Microsoft team,

I am reporting a Windows 10 22H2 Consumer ESU status inconsistency.

The device successfully installed the August 2026 cumulative update KB5120249 and reached OS build 19045.7663. The August 2026 .NET Framework update KB5121647 was also successfully installed. DISM reported no component store corruption, and SFC reported no system-file integrity violations.

The built-in Extended Security Updates enrollment wizard explicitly confirmed that the device was already enrolled and receiving Extended Security Updates.

Despite these conditions, Windows Update continued to display:

“Your device is missing important security and quality fixes.”

During troubleshooting, the WaaSAssessment registry data reported:

UPTODATE = 10.0.19045.7663
LATESTBUILDS included 10.0.19045.7663
LATESTSECURITYBUILDS included 10.0.19045.7663

The device therefore appeared to be fully updated according to both the installed OS build and the WaaSAssessment data, while the Windows Update UI continued to report the opposite status.

Windows Update services were restarted and the Windows Update cache was rebuilt, but the red banner persisted. The WaaSAssessment registry state was then backed up, reset, minimally recreated, and the device was restarted. After that restart, the Windows Update page changed to “You’re up to date” and the red warning disappeared.

This registry procedure was used only as a troubleshooting workaround; I am not presenting it as an officially supported Microsoft remediation.

Based on this behavior, the issue appears to involve a stale or inconsistent Windows Update/WaaSAssessment status state rather than an actually missing Windows security or quality update.

Could Microsoft please investigate the underlying cause of this status mismatch and provide an officially supported remediation or product-level fix so that users do not need to manually modify registry state?

The attached public evidence pack contains sanitized screenshots and the relevant high-level diagnostic results. Sensitive licensing and product identifiers have intentionally been excluded.

Thank you for investigating this behavior and helping prevent similar Windows 10 Consumer ESU users from seeing a misleading update-status warning.

0 comments

2 answers

Your answer

Answer 1

abbodi86 5,081

It's never-ending issue

https://learn.microsoft.com/en-us/answers/questions/5655936/device-missing-important-security-and-quality-issu

waiting 2 or 3 days usually fixed it, as WaaSAssessment is reevaluated

and no, "usoclient startassessment" command does not exist nor it trigger any WaaSAssessment

0 comments

Answer 2

Thoura Sopheak Nanta 655

Hi @Rajat Pandey

The issue your describing is clearly a cosmetic issue.

The Windows Update UI in Settings reads the data from WaaSAssesment, In your case, it's likely misreporting stale state data, backing up, resetting WaaSAssesment helped because it forced Windows to recreate a fresh WaaSAssesment hive, and forced Windows to reassess.

This can also be fixed using this command:

usoclient startscan
usoclient startassessment

The commands forces Windows update to reassess.

If you want to submit feedback to Microsoft, press Win + F.

Best regards,

Nanta

Rajat Pandey 0 Reputation points

2026-08-21T03:49:19.4366667+00:00
Thank you, Nanta. Your explanation is consistent with what I observed in this case.

I agree that the behavior appears to have been related to a stale or inconsistent WaaS Assessment state rather than an actual missing cumulative update. Microsoft’s WaaS Assessment documentation also describes the assessment as determining whether the device is up to date, and notes that assessment information can be cached.

In my case, however, I had already run usoclient StartScan and also manually triggered the Windows Update Schedule Scan task. The red warning remained afterward.

The more significant observation was that the WaaSAssessment registry state contained:

UPTODATE = 10.0.19045.7663

LATESTBUILDS = 10.0.19045.7663

LATESTSECURITYBUILDS = 10.0.19045.7663

CURRENT = 10.0.28000.2796

The installed OS was already Windows 10 22H2 build 19045.7663, and the Consumer ESU wizard confirmed that the device was enrolled.

After backing up the WaaSAssessment key, I reset it and allowed Windows to recreate the assessment state. After the subsequent reboot, Windows Update changed from:

“Your device is missing important security and quality fixes”

to:

“You’re up to date”

with the green check.

So, I agree with your characterization of this as an apparent assessment/UI state inconsistency. I am deliberately not presenting the registry reset as an official Microsoft fix; it is only the workaround that resolved the condition on this particular device.

The remaining question I would be interested in clarifying is whether this type of stale WaaSAssessment state is a known Windows 10 Consumer ESU scenario, particularly after a clean installation and successful ESU enrollment.

Thanks again @Thoura Sopheak Nanta for pointing out the assessment angle.

Regards,

Rajat Pandey