LG Monitors Silently Install Software via Windows Update Without Consent

LG Electronics has been caught using Microsoft's Windows Update distribution channel to silently install proprietary software on Windows systems connected to LG monitors — without prompting users or notifying them that anything is being installed.

What Happened

Users and IT administrators have found LG monitor utilities — including tools like LG OnScreen Control — delivered as optional hardware-associated packages through Windows Update. On machines configured to apply optional or driver updates automatically (the default for most consumer systems and common in managed enterprise environments), these packages install silently in the background. Affected users only discover the software after noticing new startup entries, unexpected processes, or unfamiliar programs in their installed software list.

The packages are tied to the monitor's hardware ID, so Windows Update automatically associates them with any system where an LG display is detected — no click, no prompt, no confirmation.

Why It Matters

Windows Update occupies a uniquely trusted position in the software delivery ecosystem. Enterprises grant it elevated privileges precisely because Microsoft controls what flows through it. Using that channel to push OEM vendor utilities without a consent dialog breaks that trust model in a way that has real security implications:

• Unvetted software on managed endpoints. WSUS and Intune policies that gate application deployments may not intercept hardware-associated optional packages the same way they screen conventional app installs.
• Expanded attack surface. Any silently installed software with network connectivity or auto-update capabilities widens the footprint of a managed endpoint without IT's knowledge.
• Potential compliance violations. LG utilities historically phone home to LG servers for firmware checks and usage telemetry. On a corporate endpoint, that outbound traffic may violate data governance or acceptable-use policies.
• Precedent. Letting this go unchallenged normalizes Windows Update as a stealthy delivery vector for any hardware vendor willing to exploit the mechanism.

What To Do

Audit now. Check for unexpected LG software on Windows machines:

Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*LG*" }
# Or: winget list | findstr /i LG

Also review Settings → Windows Update → Update history for any LG-associated entries you did not explicitly approve.

Tighten update policies. In WSUS, Intune, or Group Policy, audit which optional and driver update categories are set to auto-approve — this appears to be the delivery path LG is exploiting. On unmanaged machines: Settings → Windows Update → Advanced options → disable "Receive updates for other Microsoft products" as an immediate stopgap.

Uninstall and clean up. Remove via Settings → Apps. Then audit startup entries via Task Manager or Sysinternals Autoruns for residual LG processes that may survive a standard uninstall.

Escalate if you manage a fleet. File a support case with Microsoft — vendors using the Windows Update channel for unsolicited software installs is a policy violation worth flagging through official channels, both to trigger investigation and to create a paper trail.