Hello,
Windows updates are covered by the Microsoft Windows Default exclusion set listed in the Cisco Maintained Exclusions section under Management > Exclusions. You will need to go to the 2nd or 3rd page of exclusion sets to see it, depending on which view you're using.
Hope that helps.
-Matt