Did you actually manage windows updates properly with intune/gpo or just let it rip?