diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 0224b374cf..87e3ab8e39 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/29/2022 +ms.date: 11/30/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index df5363e3dd..98bd07aa66 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/29/2022 +ms.date: 11/30/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 7c1858edb3..f189fb67c0 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,4086 +1,4291 @@ --- -title: Policy CSP - Update -description: The Policy CSP - Update allows the IT admin, when used with Update/ActiveHoursStart, to manage a range of active hours where update reboots aren't scheduled. +title: Update Policy CSP +description: Learn more about the Update Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 11/30/2022 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 06/15/2022 -ms.reviewer: -manager: aaroncz -ms.collection: highpri +ms.topic: reference --- + + + # Policy CSP - Update - -
- - -## Update policies - -
-
- Update/ActiveHoursEnd -
-
- Update/ActiveHoursMaxRange -
-
- Update/ActiveHoursStart -
-
- Update/AllowAutoUpdate -
-
- Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork -
-
- Update/AllowMUUpdateService -
-
- Update/AllowNonMicrosoftSignedUpdate -
-
- Update/AllowUpdateService -
-
- Update/AutoRestartDeadlinePeriodInDays -
-
- Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates -
-
- Update/AutoRestartNotificationSchedule -
-
- Update/AutoRestartRequiredNotificationDismissal -
-
- Update/AutomaticMaintenanceWakeUp -
-
- Update/BranchReadinessLevel -
-
- Update/ConfigureDeadlineForFeatureUpdates -
-
- Update/ConfigureDeadlineForQualityUpdates -
-
- Update/ConfigureDeadlineGracePeriod -
-
- Update/ConfigureDeadlineGracePeriodForFeatureUpdates -
-
- Update/ConfigureDeadlineNoAutoReboot -
-
- Update/ConfigureFeatureUpdateUninstallPeriod -
-
- Update/DeferFeatureUpdatesPeriodInDays -
-
- Update/DeferQualityUpdatesPeriodInDays -
-
- Update/DeferUpdatePeriod -
-
- Update/DeferUpgradePeriod -
-
- Update/DetectionFrequency -
-
- Update/DisableDualScan -
-
- Update/DisableWUfBSafeguards -
-
- Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection -
-
- Update/EngagedRestartDeadline -
-
- Update/EngagedRestartDeadlineForFeatureUpdates -
-
- Update/EngagedRestartSnoozeSchedule -
-
- Update/EngagedRestartSnoozeScheduleForFeatureUpdates -
-
- Update/EngagedRestartTransitionSchedule -
-
- Update/EngagedRestartTransitionScheduleForFeatureUpdates -
-
- Update/ExcludeWUDriversInQualityUpdate -
-
- Update/FillEmptyContentUrls -
-
- Update/IgnoreMOAppDownloadLimit -
-
- Update/IgnoreMOUpdateDownloadLimit -
-
- Update/ManagePreviewBuilds -
-
- Update/NoUpdateNotificationDuringActiveHours -
-
- Update/PauseDeferrals -
-
- Update/PauseFeatureUpdates -
-
- Update/PauseFeatureUpdatesStartTime -
-
- Update/PauseQualityUpdates -
-
- Update/PauseQualityUpdatesStartTime -
-
- Update/PhoneUpdateRestrictions -
-
- Update/RequireDeferUpgrade -
-
- Update/RequireUpdateApproval -
-
- Update/ScheduleImminentRestartWarning -
-
- Update/ScheduleRestartWarning -
-
- Update/ScheduledInstallDay -
-
- Update/ScheduledInstallEveryWeek -
-
- Update/ScheduledInstallFirstWeek -
-
- Update/ScheduledInstallFourthWeek -
-
- Update/ScheduledInstallSecondWeek -
-
- Update/ScheduledInstallThirdWeek -
-
- Update/ScheduledInstallTime -
-
- Update/SetAutoRestartNotificationDisable -
-
- Update/SetDisablePauseUXAccess -
-
- Update/SetDisableUXWUAccess -
-
- Update/SetEDURestart -
-
- Update/SetPolicyDrivenUpdateSourceForDriverUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForFeatureUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForOtherUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForQualityUpdates -
-
- Update/SetProxyBehaviorForUpdateDetection -
-
- Update/ProductVersion -
-
- Update/TargetReleaseVersion -
-
- Update/UpdateNotificationLevel -
-
- Update/UpdateServiceUrl -
-
- Update/UpdateServiceUrlAlternate -
-
- - -
- - -**Update/ActiveHoursEnd** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots aren't scheduled. This value sets the end time. There's a 12-hour maximum from start time. - -> [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information. - -Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. - -The default is 17 (5 PM). - - - -ADMX Info: -- GP Friendly name: *Turn off auto-restart for updates during active hours* -- GP name: *ActiveHours* -- GP element: *ActiveHoursEndTime* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/ActiveHoursMaxRange** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. - -Supported values are 8-18. - -The default value is 18 (hours). - - - -ADMX Info: -- GP Friendly name: *Specify active hours range for auto-restarts* -- GP name: *ActiveHoursMaxRange* -- GP element: *ActiveHoursMaxRange* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/ActiveHoursStart** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots aren't scheduled. This value sets the start time. There's a 12-hour maximum from end time. - -> [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information. - -Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. - -The default value is 8 (8 AM). - - - -ADMX Info: -- GP Friendly name: *Turn off auto-restart for updates during active hours* -- GP name: *ActiveHours* -- GP element: *ActiveHoursStartTime* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/AllowAutoUpdate** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Enables the IT admin to manage automatic update behavior to scan, download, and install updates. - -Supported operations are Get and Replace. - -If the policy isn't configured, end-users get the default behavior (Auto download and install). - - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateMode* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0: Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -- 1: Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device isn't in use and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that don't shut down properly on restart. For more information, see [Automatic maintenance](/windows/win32/taskschd/task-maintenence). -- 2: Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device isn't in use and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update installs updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This behavior is the default for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that doesn't shut down properly on restart. For more information, see [Automatic maintenance](/windows/win32/taskschd/task-maintenence). -- 3: Auto install and restart at a specified time. You specify the installation day and time. If no day and time is specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is signed in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. -- 4: Auto install and restart at a specified time. You specify the installation day and time. If no day and time is specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is signed in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. This option is the same as `3`, but restricts end user controls on the settings page. -- 5: Turn off automatic updates. -- 6 (default): Updates automatically download and install at an optimal time determined by the device. Restart occurs outside of active hours until the deadline is reached, if configured. - -> [!IMPORTANT] -> This option should be used only for systems under regulatory compliance, as you won't get security updates as well. - - - - -
- - -**Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Option to download updates automatically over metered connections (off by default). The supported value type is integer. - + + + + + +## ActiveHoursEnd + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursEnd +``` + + + +Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. **Note**: The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange below for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default is 17 (5 PM). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-23]` | +| Default Value | 17 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ActiveHours_Title | +| Friendly Name | Turn off auto-restart for updates during active hours | +| Element Name | End | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ActiveHoursMaxRange + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursMaxRange +``` + + + +Enable this policy to specify the maximum number of hours from the start time that users can set their active hours. + +The max active hours range can be set between 8 and 18 hours. + +If you disable or do not configure this policy, the default max active hours range will be used. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[8-18]` | +| Default Value | 18 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ActiveHoursMaxRange_Title | +| Friendly Name | Specify active hours range for auto-restarts | +| Element Name | Max range | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ActiveHoursStart + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursStart +``` + + + +Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. **Note**: The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange above for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default value is 8 (8 AM). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-23]` | +| Default Value | 8 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ActiveHours_Title | +| Friendly Name | Turn off auto-restart for updates during active hours | +| Element Name | Start | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AllowAutoUpdate + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowAutoUpdate +``` + + + +Enables the IT admin to manage automatic update behavior to scan, download, and install updates. Supported operations are Get and Replace. **Important**: This option should be used only for systems under regulatory compliance, as you will not get security updates as well. If the policy is not configured, end-users get the default behavior (Auto install and restart). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 2 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. | +| 1 | Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. | +| 2 (Default) | Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. | +| 3 | Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. | +| 4 | Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. | +| 5 | Turn off automatic updates. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Configure automatic updating | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AllowAutoWindowsUpdateDownloadOverMeteredNetwork + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork +``` + + + +Enabling this policy will automatically download updates, even over metered data connections (charges may apply) + + + + A significant number of devices primarily use cellular data and don't have Wi-Fi access, which leads to a lower number of devices getting updates. Since a large number of devices have large data plans or unlimited data, this policy can unblock devices from getting updates. This policy is accessible through the Update setting in the user interface or Group Policy. + - - -ADMX Info: -- GP Friendly name: *Allow updates to be downloaded automatically over metered connections* -- GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Description framework properties**: - - -The following list shows the supported values: +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -- 0 (default) - Not allowed -- 1 - Allowed + +**Allowed values**: - - +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed | +| 1 | Allowed | + -
+ +**Group policy mapping**: - -**Update/AllowMUUpdateService** +| Name | Value | +|:--|:--| +| Name | AllowAutoWindowsUpdateDownloadOverMeteredNetwork_Title | +| Friendly Name | Allow updates to be downloaded automatically over metered connections | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | AllowAutoWindowsUpdateDownloadOverMeteredNetwork | +| ADMX File Name | WindowsUpdate.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## AllowMUUpdateService - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowMUUpdateService +``` + -
- - - + Allows the IT admin to manage whether to scan for app updates from Microsoft Update. + - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AllowMUUpdateServiceId* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 - Not configured. -- 1 - Allowed. Accepts updates received through Microsoft Update. - + + > [!NOTE] -> Setting this policy back to **0** or **Not configured** doesn't revert the configuration to receive updates from Microsoft Update automatically. In order to revert the configuration, you can run the PowerShell commands that are listed below to remove the Microsoft Update service:. - -``` -$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager" -$MUSM.RemoveService("7971f918-a847-4430-9279-4a52d1efe18d") -``` - - - - -
- - -**Update/AllowNonMicrosoftSignedUpdate** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. - -Supported operations are Get and Replace. - -This policy is specific to desktop and local publishing via WSUS for third-party updates (binaries and updates not hosted on Microsoft Update). This policy allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft, when the update is found on an intranet Microsoft update service location. - - - -The following list shows the supported values: - -- 0 - Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. -- 1 - Allowed. Accepts updates received through an intranet Microsoft update service location, if they're signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. - - - - -
- - -**Update/AllowUpdateService** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. - -Even when Windows Update is configured to receive updates from an intranet update service. It will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store. - -Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working. - -> [!NOTE] -> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. - - - -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 - Update service isn't allowed. -- 1 (default) - Update service is allowed. - - - - -
- - -**Update/AutoRestartDeadlinePeriodInDays** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Quality Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled. - -The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system, and user busy checks. - -Supported value type is integer. Default is seven days. - -Supported values range: 2-30. - -The PC must restart for certain updates to take effect. - -If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. - -If you disable or don't configure this policy, the PC will restart according to the default schedule. - -If any of the following two policies are enabled, this policy has no effect: - -1. No autorestart with signed-in users for the scheduled automatic updates installations. -2. Always automatically restart at scheduled time. - - - -ADMX Info: -- GP Friendly name: *Specify deadline before auto-restart for update installation* -- GP name: *AutoRestartDeadline* -- GP element: *AutoRestartDeadline* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Feature Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled. - -The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system, and user busy checks. - -Supported value type is integer. Default is 7 days. - -Supported values range: 2-30. - -The PC must restart for certain updates to take effect. - -If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. - -If you disable or don't configure this policy, the PC will restart according to the default schedule. - -If any of the following two policies are enabled, this policy has no effect: - -1. No autorestart with logged on users for the scheduled automatic updates installations. -2. Always automatically restart at scheduled time. - - - -ADMX Info: -- GP Friendly name: *Specify deadline before auto-restart for update installation* -- GP name: *AutoRestartDeadline* -- GP element: *AutoRestartDeadlineForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/AutoRestartNotificationSchedule** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT Admin to specify the period for autorestart reminder notifications. - -The default value is 15 (minutes). - - - -ADMX Info: -- GP Friendly name: *Configure auto-restart reminder notifications for updates* -- GP name: *AutoRestartNotificationConfig* -- GP element: *AutoRestartNotificationSchd* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supported values are 15, 30, 60, 120, and 240 (minutes). - - - - -
- - -**Update/AutoRestartRequiredNotificationDismissal** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT Admin to specify the method by which the autorestart required notification is dismissed. - - - -ADMX Info: -- GP Friendly name: *Configure auto-restart required notification for updates* -- GP name: *AutoRestartRequiredNotificationDismissal* -- GP element: *AutoRestartRequiredNotificationDismissal* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 1 (default) - Auto Dismissal. -- 2 - User Dismissal. - - - - -
- - -**Update/AutomaticMaintenanceWakeUp** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to configure if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. - -> [!Note] -> If the OS power wake policy is explicitly disabled, then this setting has no effect. - -If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if necessary. - -If you disable or don't configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. - - - -ADMX Info: -- GP Friendly name: *Automatic Maintenance WakeUp Policy* -- GP name: *WakeUpPolicy* -- GP path: *Windows Components/Maintenance Scheduler* -- GP ADMX file name: *msched.admx* - - - -Supported values: -- 0 - Disable -- 1 - Enable (Default) - - - - - - - - - -
- - -**Update/BranchReadinessLevel** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of General Availability Channel (Targeted) and General Availability Channel have been combined into one General Availability Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 isn't a supported value. - - - -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *BranchReadinessLevelId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) -- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) -- 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) -- 16 {0x10} - (default) General Availability Channel (Targeted). Device gets all applicable feature updates from General Availability Channel (Targeted) -- 32 {0x20} - General Availability Channel. Device gets feature updates from General Availability Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the General Availability Channel and General Availability Channel (Targeted) into a single General Availability Channel with a value of 16) - - - - -
- - -**Update/ConfigureDeadlineForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows admins to specify the number of days before feature updates are installed on the device automatically. Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours, according to [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot). After the deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. - - -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineForFeatureUpdates* -- GP element: *ConfigureDeadlineForFeatureUpdates* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supports a numeric value from 0-30 (2-30 in Windows 10, versions 1803 and 1709), which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. When set to 0, the update will download and install immediately upon offering, but might not finish within the day due to device availability and network connectivity. - -Default value is 7. - - - - - - - - - -
- - -**Update/ConfigureDeadlineForQualityUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows admins to specify the number of days before quality updates are installed on a device automatically. Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours, according to [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot). After deadline passes, restarts will occur regardless of active hours and users won't be able to reschedule. - - -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineForQualityUpdates* -- GP element: *ConfigureDeadlineForQualityUpdates* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supports a numeric value from 0-30 (2-30 in Windows 10, versions 1803 and 1709), which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. When set to 0, the update will download and install immediately upon offering, but might not finish within the day due to device availability and network connectivity. - -Default value is 7. - - - - - - - - - -
- - -**Update/ConfigureDeadlineGracePeriod** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When used with [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) allows the admin to specify a minimum number of days until restarts occur automatically for quality updates. Setting the grace period might extend the effective deadline set by the deadline policy. If [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) is configured but this policy isn't, then the default value of 2 will be used. - - - -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineGracePeriod* -- GP element: *ConfigureDeadlineGracePeriod* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supports a numeric value from 0-7, which indicates the minimum number of days a device will wait before it restarts automatically, after installing a required quality update. - -Default value is 2. - - - - - - - - - -
- - -**Update/ConfigureDeadlineGracePeriodForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - -When used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) allows the admin to specify a minimum number of days until restarts occur automatically for feature updates. Setting the grace period may extend the effective deadline set by the deadline policy. If [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) is configured but this policy isn't, then the value from [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) will be used; if that policy is also not configured, then the default value of 2 will be used. - - - -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineGracePeriodForFeatureUpdates* -- GP element: *ConfigureDeadlineGracePeriodForFeatureUpdates* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supports a numeric value from 0-7, which indicates the minimum number of days a device will wait before it restarts automatically, after installing a required feature update. - -Default value is 2. - - - - - - - - - -
- - -**Update/ConfigureDeadlineNoAutoReboot** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -When used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates), devices will delay automatically restarting until both the deadline and grace period have expired, even if applicable updates are already installed and pending a restart. - -When disabled, if the device has installed updates and is outside of active hours, it might attempt an automatic restart before the deadline. - - - -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineNoAutoReboot* -- GP element: *ConfigureDeadlineNoAutoReboot* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supported values: -- 1 - Enabled -- 0 (default) - Disabled - - - - - - - - - -
- - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Enable IT admin to configure feature update uninstall period. - -Values range 2 - 60 days. - -Default is 10 days. - - - - -
- - -**Update/DeferFeatureUpdatesPeriodInDays** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - -Defers Feature Updates for the specified number of days. - -Supported values are 0-365 days. - -> [!IMPORTANT] -> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. - - - -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *DeferFeatureUpdatesPeriodId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/DeferQualityUpdatesPeriodInDays** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Defers Quality Updates for the specified number of days. - -Supported values are 0-30. - - - -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *DeferQualityUpdatesPeriodId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/DeferUpdatePeriod** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to specify update delays for up to four weeks. - -Supported values are 0-4, which refers to the number of weeks to defer updates. - -If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - -If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - -OS upgrade: -- Maximum deferral: Eight months -- Deferral increment: One month -- Update type/notes: - - Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 - -Update: -- Maximum deferral: One month -- Deferral increment: One week -- Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: - - - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 - -Other/can't defer: - -- Maximum deferral: No deferral -- Deferral increment: No deferral -- Update type/notes: - Any update category not enumerated above falls into this category. - - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B - - - -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpdatePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/DeferUpgradePeriod** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to specify other upgrade delays for up to eight months. - -Supported values are 0-8, which refers to the number of months to defer upgrades. - -If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - -If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - - - -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpgradePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/DetectionFrequency** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should be enabled only when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. - - - -ADMX Info: -- GP Friendly name: *Automatic Updates detection frequency* -- GP name: *DetectionFrequency_Title* -- GP element: *DetectionFrequency_Hour2* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/DisableDualScan** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Don't allow update deferral policies to cause scans against Windows Update. If this policy isn't enabled, then configuring deferral policies will result in the client unexpectedly scanning Windows update. With the policy enabled, those scans are prevented, and users can configure deferral policies as much as they like. - -For more information about dual scan, see [Demystifying "Dual Scan"](/archive/blogs/wsus/demystifying-dual-scan) and [Improving Dual Scan on 1607](/archive/blogs/wsus/improving-dual-scan-on-1607). - -This setting is the same as the Group Policy in **Windows Components** > **Windows Update**: "Do not allow update deferral policies to cause scans against Windows Update." - -- Supported value type is integer. -- Supported operations are Add, Get, Replace, and Delete. - - - -ADMX Info: -- GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* -- GP name: *DisableDualScan* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 - Allow scan against Windows Update -- 1 - Don't allow update deferral policies to cause scans against Windows Update - - - - -
- - -**Update/DisableWUfBSafeguards** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in Windows Update for Business devices running Windows 10, version 1809 and above and installed with October 2020 security update. This policy setting specifies that a Windows Update for Business device should skip safeguards. - -Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience. - -The safeguard holds protection is provided by default to all the devices trying to update to a new Windows 10 Feature Update version via Windows Update. - -IT admins can, if necessary, opt devices out of safeguard protections using this policy setting or via the "Disable safeguards for Feature Updates" Group Policy. - -> [!NOTE] -> Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied. +> Setting this policy back to 0 or Not configured doesn't revert the configuration to receive updates from Microsoft Update automatically. In order to revert the configuration, you can run the PowerShell commands that are listed below to remove the Microsoft Update service: > -> The disable safeguards policy will revert to "Not Configured" on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft's default protection from known issues for each new feature update. -> -> Disabling safeguards doesn't guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade, as you're bypassing the protection given by Microsoft pertaining to known issues. +> ```powershell +> $MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager" +> $MUSM.RemoveService("7971f918-a847-4430-9279-4a52d1efe18d") +> ``` + - - -ADMX Info: -- GP Friendly name: *Disable safeguards for Feature Updates* -- GP name: *DisableWUfBSafeguards* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* + +**Description framework properties**: - - -The following list shows the supported values: +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. -- 1 - Safeguards aren't enabled and upgrades will be deployed without blocking on safeguards. + +**Allowed values**: - - +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed or not configured. | +| 1 | Allowed. Accepts updates received through Microsoft Update. | + -
+ +**Group policy mapping**: - -**Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection** +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Install updates for other Microsoft products | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## AllowNonMicrosoftSignedUpdate - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowNonMicrosoftSignedUpdate +``` + -
+ +Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution. Supported operations are Get and Replace. This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. + - - -To ensure the highest levels of security, we recommended using WSUS TLS certificate pinning on all devices. + + + -By default, certificate pinning for Windows Update client isn't enforced. + +**Description framework properties**: - - -ADMX Info: -- GP Friendly name: *Allow user proxy to be used as a fallback if detection using system proxy fails* -- GP name: *Allow user proxy to be used as a fallback if detection using system proxy fails* -- GP path: *Windows Update\SpecifyintranetMicrosoftupdateserviceLocation* -- GP ADMX file name: *WindowsUpdate.admx* +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + - - -The following list shows the supported values: + +**Allowed values**: -- 0 (default) - Enforce certificate pinning. -- 1 - Don't enforce certificate pinning. +| Value | Description | +|:--|:--| +| 0 | Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. | +| 1 (Default) | Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the 'Trusted Publishers' certificate store of the local computer. | + - - + + + -
+ - -**Update/EngagedRestartDeadline** + +## AllowUpdateService - -The table below shows the applicability of Windows: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowUpdateService +``` + - -
+ +Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store. Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working. **Note**: This policy applies only when the desktop or device is configured to connect to an intranet update service using the Specify intranet Microsoft update service location policy. + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + - - -For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Autorestart to Engaged restart (pending user schedule) to be executed automatically, within the specified period. + +**Allowed values**: -The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system, and user busy checks. +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AutomaticMaintenanceWakeUp + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AutomaticMaintenanceWakeUp +``` + + + +This policy setting allows you to configure Automatic Maintenance wake up policy. + +The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | WakeUp | +| Friendly Name | Automatic Maintenance WakeUp Policy | +| Location | Computer Configuration | +| Path | Windows Components > Maintenance Scheduler | +| Registry Key Name | Software\Policies\Microsoft\Windows\Task Scheduler\Maintenance | +| Registry Value Name | WakeUp | +| ADMX File Name | msched.admx | + + + + + + + + + +## AutoRestartDeadlinePeriodInDays + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AutoRestartDeadlinePeriodInDays +``` + + + +Specify the deadline before the PC will automatically restart to apply updates. The deadline can be set 2 to 14 days past the default restart date. + +The restart may happen inside active hours. + +If you disable or do not configure this policy, the PC will restart according to the default schedule. + +Enabling either of the following two policies will override the above policy: +1. No auto-restart with logged on users for scheduled automatic updates installations. +2. Always automatically restart at scheduled time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[2-30]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoRestartDeadline_Title | +| Friendly Name | Specify deadline before auto-restart for update installation | +| Element Name | Quality Updates (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AutoRestartDeadlinePeriodInDaysForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates +``` + + + +For Feature Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled. The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. Value type is integer. Default is 7 days. Supported values range: 2-30. **Note** that the PC must restart for certain updates to take effect. If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you disable or do not configure this policy, the PC will restart according to the default schedule. If any of the following two policies are enabled, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installations. Always automatically restart at scheduled time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[2-30]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoRestartDeadline_Title | +| Friendly Name | Specify deadline before auto-restart for update installation | +| Element Name | Feature Updates (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AutoRestartNotificationSchedule + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AutoRestartNotificationSchedule +``` + + + +Allows the IT Admin to specify the period for auto-restart reminder notifications. The default value is 15 (minutes). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 15 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 15 (Default) | 15 Minutes | +| 30 | 30 Minutes | +| 60 | 60 Minutes | +| 120 | 120 Minutes | +| 240 | 240 Minutes | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoRestartNotificationConfig_Title | +| Friendly Name | Configure auto-restart reminder notifications for updates | +| Element Name | Period (min) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## AutoRestartRequiredNotificationDismissal + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AutoRestartRequiredNotificationDismissal +``` + + + +Enable this policy to specify the method by which the auto-restart required notification is dismissed. When a restart is required to install updates, the auto-restart required notification is displayed. By default, the notification is automatically dismissed after 25 seconds. + +The method can be set to require user action to dismiss the notification. + +If you disable or do not configure this policy, the default method will be used. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | Auto Dismissal. | +| 2 | User Dismissal. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoRestartRequiredNotificationDismissal_Title | +| Friendly Name | Configure auto-restart required notification for updates | +| Element Name | Method | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## BranchReadinessLevel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel +``` + + + +Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 16 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) | +| 4 | {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) | +| 8 | {0x8} - Release Windows Insider build (added in Windows 10, version 1709) | +| 16 (Default) | {0x10} - Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). | +| 32 | 2 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) | +| 64 | {0x40} - Release Preview of Quality Updates Only. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferFeatureUpdates_Title | +| Friendly Name | Select when Preview Builds and Feature Updates are received | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ConfigureDeadlineForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineForFeatureUpdates +``` + + + +Number of days before feature updates are installed on devices automatically regardless of active hours. Before the deadline passes, users will be able to schedule restarts, and automatic restarts can happen outside of active hours. When set to 0, updates will download and install immediately, but might not finish within the day due to device availability and network connectivity. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 2 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineForFeatureUpdates | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineForFeatureUpdates | + + + + + + + + + +## ConfigureDeadlineForQualityUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineForQualityUpdates +``` + + + +Number of days before quality updates are installed on devices automatically regardless of active hours. Before the deadline passes, users will be able to schedule restarts, and automatic restarts can happen outside of active hours. When set to 0, updates will download and install immediately, but might not finish within the day due to device availability and network connectivity. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineForQualityUpdates | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineForQualityUpdates | + + + + + + + + + +## ConfigureDeadlineGracePeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineGracePeriod +``` + + + +Minimum number of days from update installation until restarts occur automatically for quality updates. This policy only takes effect when Update/ConfigureDeadlineForQualityUpdates is configured. If Update/ConfigureDeadlineForQualityUpdates is configured but this policy is not, then the default value of 2 days will take effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-7]` | +| Default Value | 2 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineGracePeriod | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineGracePeriod | + + + + + + + + + +## ConfigureDeadlineGracePeriodForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763.1852] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363.1474] and later
:heavy_check_mark: Windows 10, version 2004 [10.0.19041.906] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.906] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineGracePeriodForFeatureUpdates +``` + + + +Minimum number of days from update installation until restarts occur automatically for feature updates. This policy only takes effect when Update/ConfigureDeadlineForFeatureUpdates is configured. If Update/ConfigureDeadlineForFeatureUpdates is configured but this policy is not, then the value configured by Update/ConfigureDeadlineGracePeriod will be used. If Update/ConfigureDeadlineGracePeriod is also not configured, then the default value of 7 days will take effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-7]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineGracePeriodForFeatureUpdates | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineGracePeriodForFeatureUpdates | + + + + + + + + + +## ConfigureDeadlineNoAutoReboot + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoReboot +``` + + + +When enabled, devices will not automatically restart outside of active hours until the deadline and grace period have expired, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForQualityUpdates or Update/ConfigureDeadlineForFeatureUpdates is configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineNoAutoReboot | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineNoAutoReboot | + + + + + + + + + +## ConfigureDeadlineNoAutoRebootForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForFeatureUpdates +``` + + + +When enabled, devices will not automatically restart outside of active hours until the deadline and grace period have expired for feature updates, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForFeatureUpdates is configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineNoAutoRebootForFeatureUpdates | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineNoAutoRebootForFeatureUpdates | + + + + + + + + + +## ConfigureDeadlineNoAutoRebootForQualityUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineNoAutoRebootForQualityUpdates +``` + + + +When enabled, devices will not automatically restart outside of active hours until the deadline and grace period have expired for quality updates, even if an update is ready for restart. When disabled, an automatic restart may be attempted outside of active hours after update is ready for restart before the deadline is reached. Takes effect only if Update/ConfigureDeadlineForQualityUpdates is configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureDeadlineNoAutoRebootForQualityUpdates | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | ConfigureDeadlineNoAutoRebootForQualityUpdates | + + + + + + + + + +## ConfigureFeatureUpdateUninstallPeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ConfigureFeatureUpdateUninstallPeriod +``` + + + +Enable enterprises/IT admin to configure feature update uninstall period + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[2-60]` | +| Default Value | 10 | + + + + + + + + + +## DeferFeatureUpdatesPeriodInDays + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays +``` + + + +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Defers Feature Updates for the specified number of days. Supported values are 0-365 days. **Important**: The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-365]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferFeatureUpdates_Title | +| Friendly Name | Select when Preview Builds and Feature Updates are received | +| Element Name | How many days after a Feature Update is released would you like to defer the update before it is offered to the device? | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## DeferQualityUpdatesPeriodInDays + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays +``` + + + +Defers Quality Updates for the specified number of days. Supported values are 0-30. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferQualityUpdates_Title | +| Friendly Name | Select when Quality Updates are received | +| Element Name | After a quality update is released, defer receiving it for this many days | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## DeferUpdatePeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod +``` + + + +Note. Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. Allows IT Admins to specify update delays for up to 4 weeks. Supported values are 0-4, which refers to the number of weeks to defer updates. In Windows 10 Mobile Enterprise version 1511 devices set to automatic updates, for DeferUpdatePeriod to work, you must set the following:Update/RequireDeferUpgrade must be set to 1System/AllowTelemetry must be set to 1 or higherIf the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. OS upgrade:Maximum deferral: 8 monthsDeferral increment: 1 monthUpdate type/notes:Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5Update:Maximum deferral: 1 monthDeferral increment: 1 weekUpdate type/notes:If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441- Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4- Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F- Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828- Tools - B4832BD8-E735-4761-8DAF-37F882276DAB- Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F- Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83- Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0Other/cannot defer:Maximum deferral: No deferralDeferral increment: No deferralUpdate type/notes:Any update category not specifically enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferUpgrade | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | DeferUpdatePeriodId | + + + + + + + + + +## DeferUpgradePeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod +``` + + + +**Note**: Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. Allows IT Admins to specify additional upgrade delays for up to 8 months. Supported values are 0-8, which refers to the number of months to defer upgrades. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-8]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferUpgrade | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | DeferUpgradePeriodId | + + + + + + + + + +## DetectionFrequency + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DetectionFrequency +``` + + + +Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. + + + + +> [!NOTE]> +> There is a random variant of 0-4 hours applied to the scan frequency, which cannot be configured. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-22]` | +| Default Value | 22 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DetectionFrequency_Title | +| Friendly Name | Automatic Updates detection frequency | +| Element Name | interval (hours) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## DisableDualScan + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DisableDualScan +``` + + + +Enable this policy to not allow update deferral policies to cause scans against Windows Update. + +If this policy is disabled or not configured, then the Windows Update client may initiate automatic scans against Windows Update while update deferral policies are enabled. +Note: This policy applies only when the intranet Microsoft update service this computer is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect. + + + + > [!NOTE] -> If Update/EngagedDeadline is the only policy set (Update/EngagedRestartTransitionSchedule and Update/EngagedRestartSnoozeSchedule aren't set), the behavior goes from reboot required -> engaged behavior -> forced reboot after deadline is reached with a 3-day snooze period. - -Supporting value type is integer. - -Default is 14. - -Supported value range: 2 - 30. - -If no deadline is specified or deadline is set to 0, the restart won't be automatically executed, and will remain Engaged restart (for example, pending user scheduling). - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartDeadline* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/EngagedRestartDeadlineForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be executed automatically, within the specified period. - -Supported value type is integer. - -Default is 14. - -Supported value range: 2-30. - -If no deadline is specified or deadline is set to 0, the restart won't be automatically executed and will remain Engaged restart (for example, pending user scheduling). - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartDeadlineForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/EngagedRestartSnoozeSchedule** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Quality Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1-3 days. - -Supported value type is integer. - -Default is three days. - -Supported value range: 1-3. - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartSnoozeSchedule* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/EngagedRestartSnoozeScheduleForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1-3 days. - -Supported value type is integer. - -Default is three days. - -Supported value range: 1-3. - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/EngagedRestartTransitionSchedule** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. - -Supported value type is integer. - -Default value is 7 days. - -Supported value range: 2 - 30. - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartTransitionSchedule* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/EngagedRestartTransitionScheduleForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. - -Supported value type is integer. - -Default value is seven days. - -Supported value range: 2-30. - -If you disable or don't configure this policy, the default behaviors will be used. - -If any of the following policies are configured, this policy has no effect: -1. No autorestart with logged on users for scheduled automatic updates installations. -2. Always automatically restart at scheduled time. -3. Specify deadline before autorestart for update installation. - - - -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/ExcludeWUDriversInQualityUpdate** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - -Allows IT Admins to exclude Windows Update (WU) drivers during updates. - - - -ADMX Info: -- GP Friendly name: *Do not include drivers with Windows Updates* -- GP name: *ExcludeWUDriversInQualityUpdate* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Allow Windows Update drivers. -- 1 - Exclude Windows Update drivers. - - - - -
- - -**Update/FillEmptyContentUrls** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows Windows Update Agent to determine the download URL when it's missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL). - +> For more information about dual scan, see [Demystifying "Dual Scan"](/archive/blogs/wsus/demystifying-dual-scan) and [Improving Dual Scan on 1607](/archive/blogs/wsus/improving-dual-scan-on-1607). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | allow scan against Windows Update | +| 1 | do not allow update deferral policies to cause scans against Windows Update | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableDualScan_Title | +| Friendly Name | Do not allow update deferral policies to cause scans against Windows Update | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | DisableDualScan | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## DisableWUfBSafeguards + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [17763.1490] and later
:heavy_check_mark: Unknown [18362.1110] and later
:heavy_check_mark: Unknown [18363.1110] and later
:heavy_check_mark: Unknown [19041.546] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DisableWUfBSafeguards +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. | +| 1 | Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. | + + + + + + + + + +## DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240.18818] and later
:heavy_check_mark: Windows 10, version 1607 [10.0.14393.4169] and later
:heavy_check_mark: Windows 10, version 1703 [10.0.15063.2108] and later
:heavy_check_mark: Windows 10, version 1709 [10.0.16299.2166] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1967] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.1697] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.1316] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363.1316] and later
:heavy_check_mark: Windows 10, version 2004 [10.0.19041.746] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.746] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection +``` + + + +Do not enforce TLS certificate pinning for Windows Update client for detecting updates. + + + + > [!NOTE] -> This setting should only be used in combination with an alternate download URL and configured to use ISV file cache. This setting is used when the intranet update service doesn't provide download URLs in the update metadata for files which are available on the alternate download server. +> To ensure the highest levels of security, we recommended using WSUS TLS certificate pinning on all devices. + - - -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP element: *CorpWUFillEmptyContentUrls* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Description framework properties**: - - -The following list shows the supported values: +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -- 0 (default) - Disabled. -- 1 - Enabled. + +**Allowed values**: - - +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + -
+ +**Group policy mapping**: - -**Update/IgnoreMOAppDownloadLimit** +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Element Name | Do not enforce TLS certificate pinning for Windows Update client for detecting updates. | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## EngagedRestartDeadline - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartDeadline +``` + -
+ +For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. **Note**: If Update/EngagedDeadline is the only policy set (Update/EngagedRestartTransitionSchedule and Update/EngagedRestartSnoozeSchedule are not set), the behavior goes from reboot required -> engaged behavior -> forced reboot after deadline is reached with a 3-day snooze period. Value type is integer. Default is 14. Supported value range: 2 - 30. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e. g. pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installationsAlways automatically restart at scheduled timeSpecify deadline before auto-restart for update installation + - - -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. + + + -> [!WARNING] -> Setting this policy might cause devices to incur costs from MO operators. + +**Description framework properties**: - - -The following list shows the supported values: +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[2-30]` | +| Default Value | 14 | + -- 0 (default) - Don't ignore MO download limit for apps and their updates. -- 1 - Ignore MO download limit (allow unlimited downloading) for apps and their updates. + +**Group policy mapping**: - - +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Deadline (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## EngagedRestartDeadlineForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartDeadlineForFeatureUpdates +``` + + + +For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. Value type is integer. Default is 14. Supported value range: 2 - 30. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e. g. pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installationsAlways automatically restart at scheduled timeSpecify deadline before auto-restart for update installation + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[2-30]` | +| Default Value | 14 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Deadline (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## EngagedRestartSnoozeSchedule + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartSnoozeSchedule +``` + + + +For Quality Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. Value type is integer. Default is 3 days. Supported value range: 1 - 3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installationsAlways automatically restart at scheduled timeSpecify deadline before auto-restart for update installation + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-3]` | +| Default Value | 3 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Snooze (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## EngagedRestartSnoozeScheduleForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartSnoozeScheduleForFeatureUpdates +``` + + + +For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. Value type is integer. Default is 3 days. Supported value range: 1 - 3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installationsAlways automatically restart at scheduled timeSpecify deadline before auto-restart for update installation + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-3]` | +| Default Value | 3 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Snooze (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## EngagedRestartTransitionSchedule + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartTransitionSchedule +``` + + + +Enable this policy to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 0 and 30 days from the time the restart becomes pending. + +You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. + +You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. + +If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. + +If you disable or do not configure this policy, the PC will restart following the default schedule. + +Enabling any of the following policies will override the above policy: +1. No auto-restart with logged on users for scheduled automatic updates installations +2. Always automatically restart at scheduled time +3. Specify deadline before auto-restart for update installation + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Transition (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## EngagedRestartTransitionScheduleForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/EngagedRestartTransitionScheduleForFeatureUpdates +``` + + + +For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. Value type is integer. Default value is 7 days. Supported value range: 2 - 30. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect:No auto-restart with logged on users for scheduled automatic updates installationsAlways automatically restart at scheduled timeSpecify deadline before auto-restart for update installation + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 7 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | EngagedRestartTransitionSchedule_Title | +| Friendly Name | Specify Engaged restart transition and notification schedule for updates | +| Element Name | Transition (days) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ExcludeWUDriversInQualityUpdate + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ExcludeWUDriversInQualityUpdate +``` + + + +Enable this policy to not include drivers with Windows quality updates. + +If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Windows Update drivers. | +| 1 | Exclude Windows Update drivers. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExcludeWUDriversInQualityUpdate_Title | +| Friendly Name | Do not include drivers with Windows Updates | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | ExcludeWUDriversInQualityUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## FillEmptyContentUrls + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/FillEmptyContentUrls +``` + + + +Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL). **Note**: This setting should only be used in combination with an alternate download URL and configured to use ISV file cache. This setting is used when the intranet update service does not provide download URLs in the update metadata for files which are available on the alternate download server. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Element Name | Download files with no Url in the metadata if alternate download server is set. | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## IgnoreMOAppDownloadLimit + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/IgnoreMOAppDownloadLimit +``` + + + +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. **Warning**: Setting this policy might cause devices to incur costs from MO operators. + + + + To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell: +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in [TShell](/windows-hardware/manufacture/desktop/factoryos/connect-using-tshell): + ```TShell - exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - -**Update/IgnoreMOUpdateDownloadLimit** + +**Allowed values**: - -The table below shows the applicability of Windows: +| Value | Description | +|:--|:--| +| 0 (Default) | Do not ignore MO download limit for apps and their updates. | +| 1 | Ignore MO download limit (allow unlimited downloading) for apps and their updates. | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## IgnoreMOUpdateDownloadLimit -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/Update/IgnoreMOUpdateDownloadLimit +``` + - - -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. + +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. **Warning**: Setting this policy might cause devices to incur costs from MO operators. + -> [!WARNING] -> Setting this policy might cause devices to incur costs from MO operators. - - - -The following list shows the supported values: - -- 0 (default) - Don't ignore MO download limit for OS updates. -- 1 - Ignore MO download limit (allow unlimited downloading) for OS updates. - - - + + To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell: +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell: + ```TShell - exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - -**Update/ManagePreviewBuilds** + +**Allowed values**: - -The table below shows the applicability of Windows: +| Value | Description | +|:--|:--| +| 0 (Default) | Do not ignore MO download limit for OS updates. | +| 1 | Ignore MO download limit (allow unlimited downloading) for OS updates. | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ManagePreviewBuilds -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ManagePreviewBuilds +``` + - - -Used to manage Windows 10 Insider Preview builds. + +Used to manage Windows 10 Insider Preview builds. Value type is integer. + -Supported value type is integer. + + + - - -ADMX Info: -- GP Friendly name: *Manage preview builds* -- GP name: *ManagePreviewBuilds* -- GP element: *ManagePreviewBuildsId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* + +**Description framework properties**: - - -The following list shows the supported values: +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 3 | + -- 0 - Disable Preview builds. -- 1 - Disable Preview builds once the next release is public. -- 2 - Enable Preview builds. + +**Allowed values**: - - +| Value | Description | +|:--|:--| +| 0 | Disable Preview builds | +| 1 | Disable Preview builds once the next release is public | +| 2 | Enable Preview builds | +| 3 (Default) | Preview builds is left to user selection | + -
+ +**Group policy mapping**: - -**Update/NoUpdateNotificationDuringActiveHours** +| Name | Value | +|:--|:--| +| Name | ManagePreviewBuilds_Title | +| Friendly Name | Manage preview builds | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## NoUpdateNotificationsDuringActiveHours - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/NoUpdateNotificationsDuringActiveHours +``` + -
+ +When enabled, notifications will only be disabled during active hours. Takes effect only if Update/UpdateNotificationLevel is configured to 1 or 2. To ensure that the device stays secure, a notification will still be shown if this option is selected once “Specify deadlines for automatic updates and restarts” deadline has been reached if configured, regardless of active hours. + - - -This policy can be used in conjunction with Update/ActiveHoursStart and Update/ActiveHoursEnd policies to ensure that the end user sees no update notifications during active hours until deadline is reached. Note - if no active hour period is configured then this will apply to the intelligent active hours window calculated on the device. - -Supported value type is a boolean. - -0 (Default) This configuration will provide the default behavior (notifications may display during active hours) -1: This setting will prevent notifications from displaying during active hours. - - - -ADMX Info: -- GP Friendly name: *Display options for update notifications* -- GP name: *NoUpdateNotificationDuringActiveHours* -- GP element: *NoUpdateNotificationDuringActiveHours* -- GP path: *Windows Components\WindowsUpdate\Manage end user experience* -- GP ADMX file name: *WindowsUpdate.admx* - - - -
- - - -**Update/PauseDeferrals** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. - -Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. - -If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - -If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. - - - -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *PauseDeferralsId* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Deferrals aren't paused. -- 1 - Deferrals are paused. - - - - -
- - -**Update/PauseFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - -Allows IT Admins to pause feature updates for up to 35 days. We recommend that you use the *Update/PauseFeatureUpdatesStartTime* policy, if you're running Windows 10, version 1703 or later. - - - -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *PauseFeatureUpdatesId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Feature Updates aren't paused. -- 1 - Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. - - - - -
- - -**Update/PauseFeatureUpdatesStartTime** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. - -- Supported value type is string (yyyy-mm-dd, ex. 2018-10-28). -- Supported operations are Add, Get, Delete, and Replace. - - - -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *PauseFeatureUpdatesStartId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/PauseQualityUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows IT Admins to pause quality updates. For those running Windows 10, version 1703 or later, we recommend that you use *Update/PauseQualityUpdatesStartTime* instead. - - - -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *PauseQualityUpdatesId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Quality Updates aren't paused. -- 1 - Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. - - - - -
- - -**Update/PauseQualityUpdatesStartTime** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. - -- Supported value type is string (yyyy-mm-dd, ex. 2018-10-28). -- Supported operations are Add, Get, Delete, and Replace. - - - -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *PauseQualityUpdatesStartId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/PhoneUpdateRestrictions** - - -This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupdateapproval) instead. - - - - -
- - -**Update/ProductVersion** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product. - -If no product is specified, the device will continue receiving newer versions of the Windows product it's currently on. For details about different Windows 10 versions, see [release information](/windows/release-health/release-information). - - - -ADMX Info: -- GP Friendly name: *Select the target Feature Update version* -- GP name: *TargetReleaseVersion* -- GP element: *ProductVersion* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supported value type is a string containing a Windows product. For example, "Windows 11" or "11" or "Windows 10". - - - - - - - - -By using this Windows Update for Business policy to upgrade devices to a new product (for example, Windows 11) you're agreeing that when applying this operating system to a device, either: +> This policy can be used in conjunction with Update/ActiveHoursStart and Update/ActiveHoursEnd policies to ensure that the end user sees no update notifications during active hours until deadline is reached. If no active hour period is configured then this will apply to the intelligent active hours window calculated on the device. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | NoUpdateNotificationsDuringActiveHours | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | NoUpdateNotificationsDuringActiveHours | + + + + + + + + + +## PauseDeferrals + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PauseDeferrals +``` + + + +**Note**: Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Deferrals are not paused. | +| 1 | Deferrals are paused. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferUpgrade | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | PauseDeferralsId | + + + + + + + + + +## PauseFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PauseFeatureUpdates +``` + + + +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Allows IT Admins to pause Feature Updates for up to 60 days. + + + + +> [!NOTE] +> We recommend that you use the Update/PauseFeatureUpdatesStartTime policy, if you're running Windows 10, version 1703 or later. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Feature Updates are not paused. | +| 1 | Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferFeatureUpdates_Title | +| Friendly Name | Select when Preview Builds and Feature Updates are received | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## PauseFeatureUpdatesStartTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PauseFeatureUpdatesStartTime +``` + + + +Specifies the date and time when the IT admin wants to start pausing the Feature Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferFeatureUpdates_Title | +| Friendly Name | Select when Preview Builds and Feature Updates are received | +| Element Name | Pause Preview Builds or Feature Updates starting | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## PauseQualityUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates +``` + + + +Allows IT Admins to pause Quality Updates. + + + + +> [!NOTE] +> We recommend that you use the Update/PauseQualityUpdatesStartTime policy, if you're running Windows 10, version 1703 or later. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Quality Updates are not paused. | +| 1 | Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferQualityUpdates_Title | +| Friendly Name | Select when Quality Updates are received | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## PauseQualityUpdatesStartTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PauseQualityUpdatesStartTime +``` + + + +Specifies the date and time when the IT admin wants to start pausing the Quality Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. + + + + +> [!NOTE] +> When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferQualityUpdates_Title | +| Friendly Name | Select when Quality Updates are received | +| Element Name | Pause Quality Updates starting | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## PhoneUpdateRestrictions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/PhoneUpdateRestrictions +``` + + + +This policy is deprecated. Use Update/RequireUpdateApproval instead. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-4]` | +| Default Value | 4 | + + + + + + + + + +## ProductVersion + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ProductVersion +``` + + + +Enables IT administrators to specify the product version associated with the target feature update they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see Windows release information. + + + + +Supported value type is a string containing a Windows product. For example, "Windows 11" or "11" or "Windows 10". By using this Windows Update for Business policy to upgrade devices to a new product (for example, Windows 11) you're agreeing that when applying this operating system to a device: 1. The applicable Windows license was purchased through volume licensing, or +2. You're authorized to bind your organization and are accepting on its behalf the relevant Microsoft Software License Terms found here: . -2. You're authorized to bind your organization and are accepting on its behalf the relevant Microsoft Software License Terms to be found here: (https://www.microsoft.com/Useterms). - -
- - -**Update/RequireDeferUpgrade** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|No| -|Windows SE|No|No| -|Business|Yes|No| -|Enterprise|Yes|No| -|Education|Yes|No| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. +> If no product is specified, the device will continue receiving newer versions of the Windows product it's currently on. + -Allows the IT admin to set a device to General Availability Channel train. + +**Description framework properties**: - - -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpgradePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -The following list shows the supported values: + +**Group policy mapping**: -- 0 (default) - User gets upgrades from General Availability Channel (Targeted). -- 1 - User gets upgrades from General Availability Channel. +| Name | Value | +|:--|:--| +| Name | ProductVersion | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat > DeferUpdateCat | +| Element Name | ProductVersionId | + - - + + + -
+ - -**Update/RequireUpdateApproval** + +## RequireDeferUpgrade - -The table below shows the applicability of Windows: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|No| -|Windows SE|No|No| -|Business|Yes|No| -|Enterprise|Yes|No| -|Education|Yes|No| + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade +``` + - -
+ +**Note**: Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - - + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User gets upgrades from Semi-Annual Channel (Targeted). | +| 1 | User gets upgrades from Semi-Annual Channel. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DeferUpgrade | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | +| Element Name | DeferUpgradePeriodId | + + + + + + + + + +## RequireUpdateApproval + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/RequireUpdateApproval +``` + + + +**Note**: If you previously used the Update/PhoneUpdateRestrictions policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. Supported operations are Get and Replace. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not configured. The device installs all applicable updates. | +| 1 | The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. | + + + + + + + + + +## ScheduledInstallDay + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallDay +``` + + + +Enables the IT admin to schedule the day of the update installation. The data type is a integer. Supported operations are Add, Delete, Get, and Replace. + + + + > [!NOTE] -> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end user. EULAs are approved once an update is approved. + +**Description framework properties**: -Supported operations are Get and Replace. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - - -The following list shows the supported values: + +**Allowed values**: -- 0 - Not configured. The device installs all applicable updates. -- 1 - The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. +| Value | Description | +|:--|:--| +| 0 (Default) | Every day | +| 1 | Sunday | +| 2 | Monday | +| 3 | Tuesday | +| 4 | Wednesday | +| 5 | Thursday | +| 6 | Friday | +| 7 | Saturday | + - - + +**Group policy mapping**: -
+| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Scheduled install day | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + - -**Update/ScheduleImminentRestartWarning** + + + - -The table below shows the applicability of Windows: + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +## ScheduledInstallEveryWeek - -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallEveryWeek +``` + -> [!div class = "checklist"] -> * Device + +Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values:0 - no update in the schedule1 - update is scheduled every week + -
- - - -Allows the IT Admin to specify the period for autorestart imminent warning notifications. - -The default value is 15 (minutes). - - - -ADMX Info: -- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -- GP name: *RestartWarnRemind* -- GP element: *RestartWarn* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supported values are 15, 30, or 60 (minutes). - - - - -
- - -**Update/ScheduleRestartWarning** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Allows the IT Admin to specify the period for autorestart warning reminder notifications. + +**Description framework properties**: -The default value is 4 (hours). +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + - - -ADMX Info: -- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -- GP name: *RestartWarnRemind* -- GP element: *RestartWarnRemind* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Allowed values**: - - -Supported values are 2, 4, 8, 12, or 24 (hours). +| Value | Description | +|:--|:--| +| 0 | no update in the schedule | +| 1 (Default) | update is scheduled every week | + - - + +**Group policy mapping**: -
+| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Every week | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + - -**Update/ScheduledInstallDay** + + + - -The table below shows the applicability of Windows: + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +## ScheduledInstallFirstWeek - -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallFirstWeek +``` + -> [!div class = "checklist"] -> * Device + +Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. Supported values:0 - no update in the schedule1 - update is scheduled every first week of the month + -
- - - + + > [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Enables the IT admin to schedule the day of the update installation. + +**Description framework properties**: -Supported data type is an integer. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -Supported operations are Add, Delete, Get, and Replace. + +**Allowed values**: - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateSchDay* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +| Value | Description | +|:--|:--| +| 0 (Default) | no update in the schedule | +| 1 | update is scheduled every first week of the month | + - - -The following list shows the supported values: + +**Group policy mapping**: -- 0 (default) - Every day -- 1 - Sunday -- 2 - Monday -- 3 - Tuesday -- 4 - Wednesday -- 5 - Thursday -- 6 - Friday -- 7 - Saturday +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | First week of the month | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + - - + + + -
+ - -**Update/ScheduledInstallEveryWeek** + +## ScheduledInstallFourthWeek - -The table below shows the applicability of Windows: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallFourthWeek +``` + - -
+ +Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. Supported values:0 - no update in the schedule1 - update is scheduled every fourth week of the month + - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Enables the IT admin to schedule the update installation on every week. + +**Description framework properties**: -Supported Value type is integer. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -Supported values: -- 0 - no update in the schedule. -- 1 - update is scheduled every week. + +**Allowed values**: +| Value | Description | +|:--|:--| +| 0 (Default) | no update in the schedule | +| 1 | update is scheduled every fourth week of the month | + - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateSchEveryWeek* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Group policy mapping**: - - +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Fourth week of the month | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + -
+ + + - -**Update/ScheduledInstallFirstWeek** + - -The table below shows the applicability of Windows: + +## ScheduledInstallSecondWeek -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + - -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallSecondWeek +``` + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. Supported values:0 - no update in the schedule1 - update is scheduled every second week of the month + -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Enables the IT admin to schedule the update installation on the first week of the month. + +**Description framework properties**: -Supported value type is integer. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -Supported values: -- 0 - no update in the schedule. -- 1 - update is scheduled every first week of the month. + +**Allowed values**: +| Value | Description | +|:--|:--| +| 0 (Default) | no update in the schedule | +| 1 | update is scheduled every second week of the month | + - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateSchFirstWeek* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Group policy mapping**: - - +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Second week of the month | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + -
+ + + - -**Update/ScheduledInstallFourthWeek** + - -The table below shows the applicability of Windows: + +## ScheduledInstallThirdWeek -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + - -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallThirdWeek +``` + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. Supported values:0 - no update in the schedule1 - update is scheduled every third week of the month + -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. +> This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. + -Enables the IT admin to schedule the update installation on the fourth week of the month. + +**Description framework properties**: -Supported value type is integer. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + -Supported values: -- 0 - no update in the schedule. -- 1 - update is scheduled every fourth week of the month. + +**Allowed values**: +| Value | Description | +|:--|:--| +| 0 (Default) | no update in the schedule | +| 1 | update is scheduled every third week of the month | + - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *ScheduledInstallFourthWeek* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +**Group policy mapping**: - - +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Third week of the month | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + -
+ + + - -**Update/ScheduledInstallSecondWeek** + - -The table below shows the applicability of Windows: + +## ScheduledInstallTime -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + - -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduledInstallTime +``` + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +**Note**: This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile EnterpriseEnables the IT admin to schedule the time of the update installation. The data type is a integer. Supported operations are Add, Delete, Get, and Replace. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. + -> [!div class = "checklist"] -> * Device - -
- - - + + > [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. - -Enables the IT admin to schedule the update installation on the second week of the month. - -Supported value type is integer. - -Supported values: - -- 0 - no update in the schedule. -- 1 - update is scheduled every second week of the month. - - - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *ScheduledInstallSecondWeek* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/ScheduledInstallThirdWeek** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. - -Enables the IT admin to schedule the update installation on the third week of the month. - -Supported value type is integer. - -Supported values: -- 0 - no update in the schedule. -- 1 - update is scheduled every third week of the month. - - - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *ScheduledInstallThirdWeek* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/ScheduledInstallTime** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. - -Enables the IT admin to schedule the time of the update installation. Note that there is a window of approximately 30 minutes to allow for higher success rates of installation. - -The supported data type is an integer. - -Supported operations are Add, Delete, Get, and Replace. - -Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. - -The default value is 3. - - - -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateSchTime* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/SetAutoRestartNotificationDisable** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Allows the IT Admin to disable autorestart notifications for update installations. - - - -ADMX Info: -- GP Friendly name: *Turn off auto-restart notifications for update installations* -- GP name: *AutoRestartNotificationDisable* -- GP element: *AutoRestartNotificationSchd* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Enabled -- 1 - Disabled - - - - -
- - -**Update/SetDisablePauseUXAccess** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy allows the IT admin to disable the "Pause Updates" feature. When this policy is enabled, the user can't access the "Pause updates" feature. - -Supported value type is integer. - -Default is 0. - -Supported values 0, 1. - - - -ADMX Info: -- GP name: *SetDisablePauseUXAccess* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/SetDisableUXWUAccess** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy allows the IT admin to remove access to scan Windows Update. When this policy is enabled, the user can't access the Windows Update scan, download, and install features. - -Supported value type is integer. - -Default is 0. - -Supported values 0, 1. - - - -ADMX Info: -- GP name: *SetDisableUXWUAccess* -- GP ADMX file name: *WindowsUpdate.admx* - - - - -
- - -**Update/SetEDURestart** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime. - -When you set this policy along with Update/ActiveHoursStart, Update/ActiveHoursEnd, and ShareCartPC, it will defer all the update processes (scan, download, install, and reboot) to a time after Active Hours. After a buffer period, after ActiveHoursEnd, the device will wake up several times to complete the processes. All processes are blocked before ActiveHoursStart. - - - -ADMX Info: -- GP Friendly name: *Update Power Policy for Cart Restarts* -- GP name: *SetEDURestart* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 - not configured -- 1 - configured - - - - -
- - -**Update/SetPolicyDrivenUpdateSourceForDriverUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server. - -If you configure this policy, also configure the scan source policies for other update types: -- SetPolicyDrivenUpdateSourceForFeatureUpdates -- SetPolicyDrivenUpdateSourceForQualityUpdates -- SetPolicyDrivenUpdateSourceForOtherUpdates - ->[!NOTE] ->If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. - - - -ADMX Info: -- GP Friendly name: *Specify source service for specific classes of Windows Updates* -- GP name: *SetPolicyDrivenUpdateSourceForDriver* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0: (Default) Detect, download, and deploy Drivers from Windows Update. -- 1: Enabled, Detect, download, and deploy Drivers from Windows Server Update Server (WSUS). - - - - -
- - -**Update/SetPolicyDrivenUpdateSourceForFeatureUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Configure this policy to specify whether to receive Windows Feature Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server. - -If you configure this policy, also configure the scan source policies for other update types: -- SetPolicyDrivenUpdateSourceForQualityUpdates -- SetPolicyDrivenUpdateSourceForDriverUpdates -- SetPolicyDrivenUpdateSourceForOtherUpdates - ->[!NOTE] ->If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. - - - -ADMX Info: -- GP Friendly name: *Specify source service for specific classes of Windows Updates* -- GP name: *SetPolicyDrivenUpdateSourceForFeature* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0: (Default) Detect, download, and deploy Feature Updates from Windows Update. -- 1: Enabled, Detect, download, and deploy Feature Updates from Windows Server Update Server (WSUS). - - - - -
- - -**Update/SetPolicyDrivenUpdateSourceForOtherUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Configure this policy to specify whether to receive Other Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server. - -If you configure this policy, also configure the scan source policies for other update types: -- SetPolicyDrivenUpdateSourceForFeatureUpdates -- SetPolicyDrivenUpdateSourceForQualityUpdates -- SetPolicyDrivenUpdateSourceForDriverUpdates - ->[!NOTE] ->If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. - - - -ADMX Info: -- GP Friendly name: *Specify source service for specific classes of Windows Updates* -- GP name: *SetPolicyDrivenUpdateSourceForOther* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0: (Default) Detect, download, and deploy Other updates from Windows Update. -- 1: Enabled, Detect, download, and deploy Other updates from Windows Server Update Server (WSUS). - - - - -
- - -**Update/SetPolicyDrivenUpdateSourceForQualityUpdates** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Configure this policy to specify whether to receive Windows Quality Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server. - -If you configure this policy, also configure the scan source policies for other update types: -- SetPolicyDrivenUpdateSourceForFeatureUpdates -- SetPolicyDrivenUpdateSourceForDriverUpdates -- SetPolicyDrivenUpdateSourceForOtherUpdates - ->[!NOTE] ->If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. - - - -ADMX Info: -- GP Friendly name: *Specify source service for specific classes of Windows Updates* -- GP name: *SetPolicyDrivenUpdateSourceForQuality* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0: (Default) Detect, download, and deploy Quality Updates from Windows Update. -- 1: Enabled, Detect, download, and deploy Quality Updates from Windows Server Update Server (WSUS). - - - - -
- - -**Update/SetProxyBehaviorForUpdateDetection** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP-based intranet server despite the vulnerabilities it presents. +> +> - This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. +> - There is a window of approximately 30 minutes to allow for higher success rates of installation. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-23]` | +| Default Value | 3 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoUpdateCfg | +| Friendly Name | Configure Automatic Updates | +| Element Name | Scheduled install time | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ScheduleImminentRestartWarning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduleImminentRestartWarning +``` + + + +Allows the IT Admin to specify the period for auto-restart imminent warning notifications. The default value is 15 (minutes). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 15 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 15 (Default) | 15 Minutes | +| 30 | 30 Minutes | +| 60 | 60 Minutes | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RestartWarningSchd_Title | +| Friendly Name | Configure auto-restart warning notifications schedule for updates | +| Element Name | Warning (mins) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## ScheduleRestartWarning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/ScheduleRestartWarning +``` + + + +Enable this policy to control when notifications are displayed to warn users about a scheduled restart for the update installation deadline. Users are not able to postpone the scheduled restart once the deadline has been reached and the restart is automatically executed. + +Specifies the amount of time prior to a scheduled restart to display the warning reminder to the user. + +You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work. + +If you disable or do not configure this policy, the default notification behaviors will be used. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 4 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | 2 Hours | +| 4 (Default) | 4 Hours | +| 8 | 8 Hours | +| 12 | 12 Hours | +| 24 | 24 Hours | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RestartWarningSchd_Title | +| Friendly Name | Configure auto-restart warning notifications schedule for updates | +| Element Name | Reminder (hours) | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetAutoRestartNotificationDisable + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetAutoRestartNotificationDisable +``` + + + +Allows the IT Admin to disable auto-restart notifications for update installations. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enabled | +| 1 | Disabled | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoRestartNotificationDisable_Title | +| Friendly Name | Turn off auto-restart notifications for update installations | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Legacy Policies | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetDisablePauseUXAccess + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetDisablePauseUXAccess +``` + + + +This policy allows the IT admin to disable the Pause Updates feature. When this policy is enabled, the user cannot access the Pause updates feature. Value type is integer. Default is 0. Supported values 0, 1. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Enable | +| 0 (Default) | Disable | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDisablePauseUXAccess | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | + + + + + + + + + +## SetDisableUXWUAccess + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetDisableUXWUAccess +``` + + + +This policy allows the IT admin to remove access to scan Windows Update. When this policy is enabled, the user cannot access the Windows Update scan, download, and install features. Value type is integer. Default is 0. Supported values 0, 1. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled | +| 1 | Enabled | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDisableUXWUAccess | +| Path | WindowsUpdate > AT > WindowsComponents > WindowsUpdateCat | + + + + + + + + + +## SetEDURestart + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetEDURestart +``` + + + +Enabling this policy for EDU devices that remain on Carts overnight will skip power checks to ensure update reboots will happen at the scheduled install time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | not configured | +| 1 | configured | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetEDURestart_Title | +| Friendly Name | Update Power Policy for Cart Restarts | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | SetEDURestart | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetPolicyDrivenUpdateSourceForDriverUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForDriverUpdates +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Detect, download and deploy Driver Updates from Windows Update | +| 1 (Default) | Detect, download and deploy Driver Updates from Windows Server Update Services (WSUS) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetPolicyDrivenUpdateSourceForFeatureUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForFeatureUpdates +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Detect, download and deploy Feature Updates from Windows Update | +| 1 (Default) | Detect, download and deploy Feature Updates from Windows Server Update Services (WSUS) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetPolicyDrivenUpdateSourceForOtherUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForOtherUpdates +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Detect, download and deploy other Updates from Windows Update | +| 1 (Default) | Detect, download and deploy other Updates from Windows Server Update Services (WSUS) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetPolicyDrivenUpdateSourceForQualityUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForQualityUpdates +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Detect, download and deploy Quality Updates from Windows Update | +| 1 (Default) | Detect, download and deploy Quality Updates from Windows Server Update Services (WSUS) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## SetProxyBehaviorForUpdateDetection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240.18696] and later
:heavy_check_mark: Windows 10, version 1607 [10.0.14393.3930] and later
:heavy_check_mark: Windows 10, version 1703 [10.0.15063.2500] and later
:heavy_check_mark: Windows 10, version 1709 [10.0.16299.2107] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1726] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.1457] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.1082] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363.1082] and later
:heavy_check_mark: Windows 10, version 2004 [10.0.19041.508] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/SetProxyBehaviorForUpdateDetection +``` + + + +Select the proxy behavior for Windows Update client for detecting updates + + + + +By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP-based intranet server despite the vulnerabilities it presents. This policy setting doesn't impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS-based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. - - -ADMX Info: -- GP Friendly name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* -- GP name: *Select the proxy behavior* -- GP element: *Select the proxy behavior* -- GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- 0 (default) - Allow system proxy only for HTTP scans. -- 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. - > [!NOTE] > Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - -**Update/TargetReleaseVersion** + +**Allowed values**: - -The table below shows the applicability of Windows: +| Value | Description | +|:--|:--| +| 0 (Default) | Only use system proxy for detecting updates (default) | +| 1 | Allow user proxy to be used as a fallback if detection using system proxy fails | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Group policy mapping**: - -
+| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Element Name | Select the proxy behavior for Windows Update client for detecting updates | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## TargetReleaseVersion - - -Available in Windows 10, version 1803 and later. Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](/windows/release-health/release-information/). + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134.1488] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.1217] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.836] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363.836] and later
:heavy_check_mark: Windows 10, version 2004 [10.0.19041] and later | + - - -ADMX Info: -- GP Friendly name: *Select the target Feature Update version* -- GP name: *TargetReleaseVersion* -- GP element: *TargetReleaseVersionInfo* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* - - - -Supported value type is a string containing Windows 10 version number. For example, 1809, 1903. - - - - - - - - - -
- - -**Update/UpdateNotificationLevel** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Display options for update notifications. This policy allows you to define what Windows Update notifications users see. This policy doesn't control how and when updates are downloaded and installed. - -Options: - -- 0 (default) - Use the default Windows Update notifications. -- 1 - Turn off all notifications, excluding restart warnings. -- 2 - Turn off all notifications, including restart warnings. - -> [!IMPORTANT] -> If you choose not to get update notifications and also define other Group policies so that devices aren't automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. - - - -ADMX Info: -- GP Friendly name: *Display options for update notifications* -- GP name: *UpdateNotificationLevel* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - - - - - - -
- - -**Update/UpdateServiceUrl** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!IMPORTANT] -> Starting in Windows 10, version 1703 this policy isn't supported in IoT Mobile. - -Allows the device to check for updates from a WSUS server instead of Microsoft Update. This setting is useful for on-premises MDMs that need to update devices that can't connect to the Internet. - -Supported operations are Get and Replace. - - - -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP element: *CorpWUURL_Name* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* - - - -The following list shows the supported values: - -- Not configured. The device checks for updates from Microsoft Update. -- Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL. - - - -Example - -```xml - - $CmdID$ - - - chr - text/plain - - - ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl - - http://abcd-srv:8530 - - + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/TargetReleaseVersion ``` + - - + +Available in Windows 10, version 1803 and later. Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see Windows 10 release information. + -
+ + + - -**Update/UpdateServiceUrlAlternate** + +**Description framework properties**: - -The table below shows the applicability of Windows: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Group policy mapping**: - -
+| Name | Value | +|:--|:--| +| Name | TargetReleaseVersion_Title | +| Friendly Name | Select the target Feature Update version | +| Element Name | Target Version for Feature Updates | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Update | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## UpdateNotificationLevel - - -Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + -This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/UpdateNotificationLevel +``` + -To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. + +0 (default) – Use the default Windows Update notifications +1 – Turn off all notifications, excluding restart warnings +2 – Turn off all notifications, including restart warnings -Supported value type is string and the default value is an empty string, "". If the setting isn't configured, and if Automatic Updates isn't disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +This policy allows you to define what Windows Update notifications users see. This policy doesn’t control how and when updates are downloaded and installed. -> [!NOTE] -> If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. -> If the "Alternate Download Server" Group Policy isn't set, it will use the WSUS server by default to download updates. -> This policy isn't supported on Windows RT. Setting this policy won't have any effect on Windows RT PCs. +Important: if you choose not to get update notifications and also define other Group policy so that devices aren’t automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. - - -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP element: *CorpWUContentHost_Name* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +If you select “Apply only during active hours” in conjunction with Option 1 or 2, then notifications will only be disabled during active hours. You can set active hours by setting “Turn off auto-restart for updates during active hours” or allow the device to set active hours based on user behavior. To ensure that the device stays secure, a notification will still be shown if this option is selected once “Specify deadlines for automatic updates and restarts” deadline has been reached if configured, regardless of active hours. + - - -
+ + + - + +**Description framework properties**: -## Related topics +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Use the default Windows Update notifications | +| 1 | Turn off all notifications, excluding restart warnings | +| 2 | Turn off all notifications, including restart warnings | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | UpdateNotificationLevel_Title | +| Friendly Name | Display options for update notifications | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | SetUpdateNotificationLevel | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## UpdateServiceUrl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl +``` + + + +**Important**: Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Mobile. Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. Supported operations are Get and Replace. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Default Value | CorpWSUS | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Element Name | Set the intranet update service for detecting updates | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + +## UpdateServiceUrlAlternate + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/UpdateServiceUrlAlternate +``` + + + +Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. **Note**: If the Configure Automatic Updates Group Policy is disabled, then this policy has no effect. If the Alternate Download Server Group Policy is not set, it will use the WSUS server by default to download updates. This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CorpWuURL | +| Friendly Name | Specify intranet Microsoft update service location | +| Element Name | Set the alternate download server | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + + + + + + + +## Related articles [Policy configuration service provider](policy-configuration-service-provider.md)