9

Policy CSP - Update

 3 years ago
source link: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update?WT_mc_id=EM-MVP-5001447
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

Policy CSP - Update

  • 11/03/2020
  • 44 minutes to read

In this article

  1. Update policies

Update policies

Update/ActiveHoursEnd Update/ActiveHoursMaxRange Update/ActiveHoursStart Update/AllowAutoUpdate Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork Update/AllowMUUpdateService Update/AllowNonMicrosoftSignedUpdate Update/AllowUpdateService Update/AutoRestartDeadlinePeriodInDays Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates Update/AutoRestartNotificationSchedule Update/AutoRestartRequiredNotificationDismissal Update/AutomaticMaintenanceWakeUp Update/BranchReadinessLevel Update/ConfigureDeadlineForFeatureUpdates Update/ConfigureDeadlineForQualityUpdates Update/ConfigureDeadlineGracePeriod Update/ConfigureDeadlineNoAutoReboot Update/ConfigureFeatureUpdateUninstallPeriod Update/DeferFeatureUpdatesPeriodInDays Update/DeferQualityUpdatesPeriodInDays Update/DeferUpdatePeriod Update/DeferUpgradePeriod Update/DetectionFrequency Update/DisableDualScan Update/DisableWUfBSafeguards Update/EngagedRestartDeadline Update/EngagedRestartDeadlineForFeatureUpdates Update/EngagedRestartSnoozeSchedule Update/EngagedRestartSnoozeScheduleForFeatureUpdates Update/EngagedRestartTransitionSchedule Update/EngagedRestartTransitionScheduleForFeatureUpdates Update/ExcludeWUDriversInQualityUpdate Update/FillEmptyContentUrls Update/IgnoreMOAppDownloadLimit Update/IgnoreMOUpdateDownloadLimit Update/ManagePreviewBuilds Update/PauseDeferrals Update/PauseFeatureUpdates Update/PauseFeatureUpdatesStartTime Update/PauseQualityUpdates Update/PauseQualityUpdatesStartTime Update/PhoneUpdateRestrictions Update/RequireDeferUpgrade Update/RequireUpdateApproval Update/ScheduleImminentRestartWarning Update/ScheduleRestartWarning Update/ScheduledInstallDay Update/ScheduledInstallEveryWeek Update/ScheduledInstallFirstWeek Update/ScheduledInstallFourthWeek Update/ScheduledInstallSecondWeek Update/ScheduledInstallThirdWeek Update/ScheduledInstallTime Update/SetAutoRestartNotificationDisable Update/SetDisablePauseUXAccess Update/SetDisableUXWUAccess Update/SetEDURestart Update/SetProxyBehaviorForUpdateDetection Update/TargetReleaseVersion Update/UpdateNotificationLevel Update/UpdateServiceUrl Update/UpdateServiceUrlAlternate

Update/ActiveHoursEnd

Update policies Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time.

 The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange below for more information.

Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.

The default is 17 (5 PM).

ADMX Info:

  • GP English name: Turn off auto-restart for updates during active hours
  • GP name: ActiveHours
  • GP element: ActiveHoursEndTime
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ActiveHoursMaxRange

Table 2 Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time.

Supported values are 8-18.

The default value is 18 (hours).

ADMX Info:

  • GP English name: Specify active hours range for auto-restarts
  • GP name: ActiveHoursMaxRange
  • GP element: ActiveHoursMaxRange
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ActiveHoursStart

Table 3 Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time.

 The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange above for more information.

Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc.

The default value is 8 (8 AM).

ADMX Info:

  • GP English name: Turn off auto-restart for updates during active hours
  • GP name: ActiveHours
  • GP element: ActiveHoursStartTime
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/AllowAutoUpdate

Table 4 Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Enables the IT admin to manage automatic update behavior to scan, download, and install updates.

Supported operations are Get and Replace.

If the policy is not configured, end-users get the default behavior (Auto install and restart).

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AutoUpdateMode
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel.
  • 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart.
  • 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart.
  • 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart.
  • 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only.
  • 5 – Turn off automatic updates.

Important

This option should be used only for systems under regulatory compliance, as you will not get security updates as well.

Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork

Table 5 Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Option to download updates automatically over metered connections (off by default). Value type is integer.

A significant number of devices primarily use cellular data and do not have Wi-Fi access, which leads to a lower number of devices getting updates. Since a large number of devices have large data plans or unlimited data, this policy can unblock devices from getting updates.

This policy is accessible through the Update setting in the user interface or Group Policy.

ADMX Info:

  • GP English name: Allow updates to be downloaded automatically over metered connections
  • GP name: AllowAutoWindowsUpdateDownloadOverMeteredNetwork
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) - Not allowed
  • 1 - Allowed

Update/AllowMUUpdateService

Table 6 Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update.

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AllowMUUpdateServiceId
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 – Not allowed or not configured.
  • 1 – Allowed. Accepts updates received through Microsoft Update.

Update/AllowNonMicrosoftSignedUpdate

Table 7 Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution.

Supported operations are Get and Replace.

This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.

The following list shows the supported values:

  • 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft.
  • 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer.

Update/AllowUpdateService

Table 8 Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store

Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working.

 This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.

ADMX Info:

  • GP English name: Specify intranet Microsoft update service location
  • GP name: CorpWuURL
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 – Update service is not allowed.
  • 1 (default) – Update service is allowed.

Update/AutoRestartDeadlinePeriodInDays

Table 9 Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

For Quality Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.

The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.

Value type is integer. Default is 7 days.

Supported values range: 2-30.

Note that the PC must restart for certain updates to take effect.

If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled.

If you disable or do not configure this policy, the PC will restart according to the default schedule.

If any of the following two policies are enabled, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations.
  2. Always automatically restart at scheduled time.

ADMX Info:

  • GP English name: Specify deadline before auto-restart for update installation
  • GP name: AutoRestartDeadline
  • GP element: AutoRestartDeadline
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates

Table 10 Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

For Feature Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.

The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.

Value type is integer. Default is 7 days.

Supported values range: 2-30.

Note that the PC must restart for certain updates to take effect.

If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled.

If you disable or do not configure this policy, the PC will restart according to the default schedule.

If any of the following two policies are enabled, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations.
  2. Always automatically restart at scheduled time.

ADMX Info:

  • GP English name: Specify deadline before auto-restart for update installation
  • GP name: AutoRestartDeadline
  • GP element: AutoRestartDeadlineForFeatureUpdates
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/AutoRestartNotificationSchedule

Table 11 Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications.

The default value is 15 (minutes).

ADMX Info:

  • GP English name: Configure auto-restart reminder notifications for updates
  • GP name: AutoRestartNotificationConfig
  • GP element: AutoRestartNotificationSchd
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Supported values are 15, 30, 60, 120, and 240 (minutes).

Update/AutoRestartRequiredNotificationDismissal

Table 12 Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed.

ADMX Info:

  • GP English name: Configure auto-restart required notification for updates
  • GP name: AutoRestartRequiredNotificationDismissal
  • GP element: AutoRestartRequiredNotificationDismissal
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 1 (default) – Auto Dismissal.
  • 2 – User Dismissal.

Update/AutomaticMaintenanceWakeUp

Table 13 Windows Edition Supported? Home cross mark Pro check mark6 Business check mark6 Enterprise check mark6 Education check mark6

Scope:

  • Device

This policy setting allows you to configure if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance.

If the OS power wake policy is explicitly disabled, then this setting has no effect.

If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if required.

If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies.

ADMX Info:

  • GP English name: Automatic Maintenance WakeUp Policy
  • GP name: WakeUpPolicy
  • GP path: Windows Components/Maintenance Scheduler
  • GP ADMX file name: msched.admx

Supported values:

  • 0 - Disable (Default)
  • 1 - Enable

Update/BranchReadinessLevel

Table 14 Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value.

ADMX Info:

  • GP English name: Select when Preview Builds and Feature Updates are received
  • GP name: DeferFeatureUpdates
  • GP element: BranchReadinessLevelId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709)
  • 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709)
  • 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709)
  • 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted).
  • 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16)

Update/ConfigureDeadlineForFeatureUpdates

Table 15 Windows Edition Supported? Home cross mark Pro check mark6 Business check mark6 Enterprise check mark6 Education check mark6

Scope:

  • Device

Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.

ADMX Info:

  • GP English name: Specify deadlines for automatic updates and restarts
  • GP name: ConfigureDeadlineForFeatureUpdates
  • GP element: ConfigureDeadlineForFeatureUpdates
  • GP path: Administrative Templates\Windows Components\WindowsUpdate
  • GP ADMX file name: WindowsUpdate.admx

Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update.

Default value is 7.

Update/ConfigureDeadlineForQualityUpdates

Table 16 Windows Edition Supported? Home cross mark Pro check mark6 Business check mark6 Enterprise check mark6 Education check mark6

Scope:

  • Device

Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.

ADMX Info:

  • GP English name: Specify deadlines for automatic updates and restarts
  • GP name: ConfigureDeadlineForQualityUpdates
  • GP element: ConfigureDeadlineForQualityUpdates
  • GP path: Administrative Templates\Windows Components\WindowsUpdate
  • GP ADMX file name: WindowsUpdate.admx

Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required quality update.

Default value is 7.

Update/ConfigureDeadlineGracePeriod

Table 17 Windows Edition Supported? Home cross mark Pro check mark6 Business check mark6 Enterprise check mark6 Education check mark6

Scope:

  • Device

Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows the IT admin (when used with Update/ConfigureDeadlineForFeatureUpdates or Update/ConfigureDeadlineForQualityUpdates) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies.

ADMX Info:

  • GP English name: Specify deadlines for automatic updates and restarts
  • GP name: ConfigureDeadlineGracePeriod
  • GP element: ConfigureDeadlineGracePeriod
  • GP path: Administrative Templates\Windows Components\WindowsUpdate
  • GP ADMX file name: WindowsUpdate.admx

Supports a numeric value from 0 - 7, which indicates the minimum number of days a device will wait until performing an aggressive installation of a required update once deadline has been reached.

Default value is 2.

Update/ConfigureDeadlineNoAutoReboot

Table 18 Windows Edition Supported? Home cross mark Pro check mark6 Business check mark6 Enterprise check mark6 Education check mark6

Scope:

  • Device

Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. If enabled (when used with Update/ConfigureDeadlineForFeatureUpdates or Update/ConfigureDeadlineForQualityUpdates), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart.

When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline.

ADMX Info:

  • GP English name: Specify deadlines for automatic updates and restarts
  • GP name: ConfigureDeadlineNoAutoReboot
  • GP element: ConfigureDeadlineNoAutoReboot
  • GP path: Administrative Templates\Windows Components\WindowsUpdate
  • GP ADMX file name: WindowsUpdate.admx

Supported values:

  • 1 - Enabled
  • 0 (default) - Disabled

Update/ConfigureFeatureUpdateUninstallPeriod

Table 19 Windows Edition Supported? Home cross mark Pro check mark4 Business check mark4 Enterprise check mark4 Education check mark4

Scope:

  • Device

Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days.

Update/DeferFeatureUpdatesPeriodInDays

Table 20 Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days.

Supported values are 0-365 days.

Important

 The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703.

ADMX Info:

  • GP English name: Select when Preview Builds and Feature Updates are received
  • GP name: DeferFeatureUpdates
  • GP element: DeferFeatureUpdatesPeriodId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

Update/DeferQualityUpdatesPeriodInDays

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days.

Supported values are 0-30.

ADMX Info:

  • GP English name: Select when Quality Updates are received
  • GP name: DeferQualityUpdates
  • GP element: DeferQualityUpdatesPeriodId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

Update/DeferUpdatePeriod

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices.

Allows IT Admins to specify update delays for up to 4 weeks.

Supported values are 0-4, which refers to the number of weeks to defer updates.

In Windows 10 Mobile Enterprise version 1511 devices set to automatic updates, for DeferUpdatePeriod to work, you must set the following:

  • Update/RequireDeferUpgrade must be set to 1
  • System/AllowTelemetry must be set to 1 or higher

If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

OS upgrade:

  • Maximum deferral: 8 months
  • Deferral increment: 1 month
  • Update type/notes:
    • Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5

Update:

  • Maximum deferral: 1 month
  • Deferral increment: 1 week
  • Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0

Other/cannot defer:

  • Maximum deferral: No deferral
  • Deferral increment: No deferral
  • Update type/notes: Any update category not specifically enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B

ADMX Info:

  • GP name: DeferUpgrade
  • GP element: DeferUpdatePeriodId
  • GP ADMX file name: WindowsUpdate.admx

Update/DeferUpgradePeriod

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices.

Allows IT Admins to specify additional upgrade delays for up to 8 months.

Supported values are 0-8, which refers to the number of months to defer upgrades.

If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

ADMX Info:

  • GP name: DeferUpgrade
  • GP element: DeferUpgradePeriodId
  • GP ADMX file name: WindowsUpdate.admx

Update/DetectionFrequency

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should only be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update.

ADMX Info:

  • GP English name: Automatic Updates detection frequency
  • GP name: DetectionFrequency_Title
  • GP element: DetectionFrequency_Hour2
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/DisableDualScan

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709, but was added to 1607 and 1703 service releases. Do not allow update deferral policies to cause scans against Windows Update. If this policy is not enabled, then configuring deferral policies will result in the client unexpectedly scanning Windows update. With the policy enabled, those scans are prevented, and users can configure deferral policies as much as they like.

For more information about dual scan, see Demystifying "Dual Scan" and Improving Dual Scan on 1607.

This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update."

Value type is integer. Supported operations are Add, Get, Replace, and Delete.

ADMX Info:

  • GP English name: Do not allow update deferral policies to cause scans against Windows Update
  • GP name: DisableDualScan
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 - allow scan against Windows Update
  • 1 - do not allow update deferral policies to cause scans against Windows Update

Update/DisableWUfBSafeguards

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

Available in Windows Update for Business (WUfB) devices running Windows 10, version 1809 and above and installed with October 2020 security update. This policy setting specifies that a WUfB device should skip safeguards.

Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience.

The safeguard holds protection is provided by default to all the devices trying to update to a new Windows 10 Feature Update version via Windows Update.

IT admins can, if necessary, opt devices out of safeguard protections using this policy setting or via the “Disable safeguards for Feature Updates” Group Policy.

Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied.

The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.

Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues.

ADMX Info:

  • GP English name: Disable safeguards for Feature Updates
  • GP name: DisableWUfBSafeguards
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared.
  • 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards.

Update/EngagedRestartDeadline

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.

The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.

If Update/EngagedDeadline is the only policy set (Update/EngagedRestartTransitionSchedule and Update/EngagedRestartSnoozeSchedule are not set), the behavior goes from reboot required -> engaged behavior -> forced reboot after deadline is reached with a 3-day snooze period.

Value type is integer. Default is 14.

Supported value range: 2 - 30.

If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling).

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartDeadline
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/EngagedRestartDeadlineForFeatureUpdates

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.

Value type is integer. Default is 14.

Supported value range: 2 - 30.

If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling).

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartDeadlineForFeatureUpdates
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/EngagedRestartSnoozeSchedule

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

For Quality Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.

Value type is integer. Default is 3 days.

Supported value range: 1 - 3.

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartSnoozeSchedule
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/EngagedRestartSnoozeScheduleForFeatureUpdates

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days.

Value type is integer. Default is 3 days.

Supported value range: 1 - 3.

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartSnoozeScheduleForFeatureUpdates
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/EngagedRestartTransitionSchedule

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.

Value type is integer. Default value is 7 days.

Supported value range: 2 - 30.

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartTransitionSchedule
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/EngagedRestartTransitionScheduleForFeatureUpdates

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.

Value type is integer. Default value is 7 days.

Supported value range: 2 - 30.

If you disable or do not configure this policy, the default behaviors will be used.

If any of the following policies are configured, this policy has no effect:

  1. No auto-restart with logged on users for scheduled automatic updates installations
  2. Always automatically restart at scheduled time
  3. Specify deadline before auto-restart for update installation

ADMX Info:

  • GP English name: Specify Engaged restart transition and notification schedule for updates
  • GP name: EngagedRestartTransitionSchedule
  • GP element: EngagedRestartTransitionScheduleForFeatureUpdates
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ExcludeWUDriversInQualityUpdate

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates.

ADMX Info:

  • GP English name: Do not include drivers with Windows Updates
  • GP name: ExcludeWUDriversInQualityUpdate
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Allow Windows Update drivers.
  • 1 – Exclude Windows Update drivers.

Update/FillEmptyContentUrls

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in the April service release of Windows 10, version 1607. Allows Windows Update Agent to determine the download URL when it is missing from the metadata. This scenario will occur when intranet update service stores the metadata files but the download contents are stored in the ISV file cache (specified as the alternate download URL).

This setting should only be used in combination with an alternate download URL and configured to use ISV file cache. This setting is used when the intranet update service does not provide download URLs in the update metadata for files which are available on the alternate download server.

ADMX Info:

  • GP English name: Specify intranet Microsoft update service location
  • GP name: CorpWuURL
  • GP element: CorpWUFillEmptyContentUrls
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Disabled.
  • 1 – Enabled.

Update/IgnoreMOAppDownloadLimit

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.

Warning

Setting this policy might cause devices to incur costs from MO operators.

The following list shows the supported values:

  • 0 (default) – Do not ignore MO download limit for apps and their updates.
  • 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates.

To validate this policy:

  1. Enable the policy and ensure the device is on a cellular network.
  2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
    TShell
       exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'

Update/IgnoreMOUpdateDownloadLimit

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.

Warning

Setting this policy might cause devices to incur costs from MO operators.

The following list shows the supported values:

  • 0 (default) – Do not ignore MO download limit for OS updates.
  • 1 – Ignore MO download limit (allow unlimited downloading) for OS updates.

To validate this policy:

  1. Enable the policy and ensure the device is on a cellular network.
  2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
    TShell
       exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'

Update/ManagePreviewBuilds

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Used to manage Windows 10 Insider Preview builds. Value type is integer.

ADMX Info:

  • GP English name: Manage preview builds
  • GP name: ManagePreviewBuilds
  • GP element: ManagePreviewBuildsId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 - Disable Preview builds
  • 1 - Disable Preview builds once the next release is public
  • 2 - Enable Preview builds

Update/PauseDeferrals

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use PauseDeferrals for Windows 10, version 1511 devices.

Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks.

If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.

ADMX Info:

  • GP name: DeferUpgrade
  • GP element: PauseDeferralsId
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Deferrals are not paused.
  • 1 – Deferrals are paused.

Update/PauseFeatureUpdates

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

Added in Windows 10, version 1607. Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the Update/PauseFeatureUpdatesStartTime policy if you are running Windows 10, version 1703 or later.

ADMX Info:

  • GP English name: Select when Preview Builds and Feature Updates are received
  • GP name: DeferFeatureUpdates
  • GP element: PauseFeatureUpdatesId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Feature Updates are not paused.
  • 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner.

Update/PauseFeatureUpdatesStartTime

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date.

Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace.

ADMX Info:

  • GP English name: Select when Preview Builds and Feature Updates are received
  • GP name: DeferFeatureUpdates
  • GP element: PauseFeatureUpdatesStartId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

Update/PauseQualityUpdates

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows IT Admins to pause quality updates. For those running Windows 10, version 1703 or later, we recommend that you use Update/PauseQualityUpdatesStartTime instead.

ADMX Info:

  • GP English name: Select when Quality Updates are received
  • GP name: DeferQualityUpdates
  • GP element: PauseQualityUpdatesId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Quality Updates are not paused.
  • 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner.

Update/PauseQualityUpdatesStartTime

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date.

Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace.

ADMX Info:

  • GP English name: Select when Quality Updates are received
  • GP name: DeferQualityUpdates
  • GP element: PauseQualityUpdatesStartId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

Update/PhoneUpdateRestrictions

This policy is deprecated. Use Update/RequireUpdateApproval instead.

Update/RequireDeferUpgrade

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in Changes in Windows 10, version 1607 for update management. You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices.

Allows the IT admin to set a device to Semi-Annual Channel train.

ADMX Info:

  • GP name: DeferUpgrade
  • GP element: DeferUpgradePeriodId
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted).
  • 1 – User gets upgrades from Semi-Annual Channel.

Update/RequireUpdateApproval

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

 This policy is only recommended for managing mobile devices. If you previously used the Update/PhoneUpdateRestrictions policy in previous versions of Windows, it has been deprecated. Please use this policy instead.

Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.

Supported operations are Get and Replace.

The following list shows the supported values:

  • 0 – Not configured. The device installs all applicable updates.
  • 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment.

Update/ScheduleImminentRestartWarning

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications.

The default value is 15 (minutes).

ADMX Info:

  • GP English name: Configure auto-restart warning notifications schedule for updates
  • GP name: RestartWarnRemind
  • GP element: RestartWarn
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Supported values are 15, 30, or 60 (minutes).

Update/ScheduleRestartWarning

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

 This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise

Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart warning reminder notifications.

The default value is 4 (hours).

ADMX Info:

  • GP English name: Configure auto-restart warning notifications schedule for updates
  • GP name: RestartWarnRemind
  • GP element: RestartWarnRemind
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Supported values are 2, 4, 8, 12, or 24 (hours).

Update/ScheduledInstallDay

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Enables the IT admin to schedule the day of the update installation.

The data type is a integer.

Supported operations are Add, Delete, Get, and Replace.

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AutoUpdateSchDay
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Every day
  • 1 – Sunday
  • 2 – Monday
  • 3 – Tuesday
  • 4 – Wednesday
  • 5 – Thursday
  • 6 – Friday
  • 7 – Saturday

Update/ScheduledInstallEveryWeek

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values:

  • 0 - no update in the schedule
  • 1 - update is scheduled every week

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AutoUpdateSchEveryWeek
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ScheduledInstallFirstWeek

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. Supported values:

  • 0 - no update in the schedule
  • 1 - update is scheduled every first week of the month

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AutoUpdateSchFirstWeek
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ScheduledInstallFourthWeek

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. Supported values:

  • 0 - no update in the schedule
  • 1 - update is scheduled every fourth week of the month

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: ScheduledInstallFourthWeek
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ScheduledInstallSecondWeek

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. Supported values:

  • 0 - no update in the schedule
  • 1 - update is scheduled every second week of the month

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: ScheduledInstallSecondWeek
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ScheduledInstallThirdWeek

Windows Edition Supported? Home cross mark Pro check mark3 Business check mark3 Enterprise check mark3 Education check mark3

Scope:

  • Device

Added in Windows 10, version 1709. Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. Supported values:

  • 0 - no update in the schedule
  • 1 - update is scheduled every third week of the month

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: ScheduledInstallThirdWeek
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/ScheduledInstallTime

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

 This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise

Enables the IT admin to schedule the time of the update installation.

The data type is a integer.

Supported operations are Add, Delete, Get, and Replace.

Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM.

The default value is 3.

ADMX Info:

  • GP English name: Configure Automatic Updates
  • GP name: AutoUpdateCfg
  • GP element: AutoUpdateSchTime
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/SetAutoRestartNotificationDisable

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart notifications for update installations.

ADMX Info:

  • GP English name: Turn off auto-restart notifications for update installations
  • GP name: AutoRestartNotificationDisable
  • GP element: AutoRestartNotificationSchd
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) – Enabled
  • 1 – Disabled

Update/SetDisablePauseUXAccess

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

This policy allows the IT admin to disable the "Pause Updates" feature. When this policy is enabled, the user cannot access the "Pause updates" feature.

Value type is integer. Default is 0. Supported values 0, 1.

ADMX Info:

  • GP name: SetDisablePauseUXAccess
  • GP ADMX file name: WindowsUpdate.admx

Update/SetDisableUXWUAccess

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

This policy allows the IT admin to remove access to scan Windows Update. When this policy is enabled, the user cannot access the Windows Update scan, download, and install features.

Value type is integer. Default is 0. Supported values 0, 1.

ADMX Info:

  • GP name: SetDisableUXWUAccess
  • GP ADMX file name: WindowsUpdate.admx

Update/SetEDURestart

Windows Edition Supported? Home cross mark Pro check mark2 Business check mark2 Enterprise check mark2 Education check mark2

Scope:

  • Device

Added in Windows 10, version 1703. For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime.

When you set this policy along with Update/ActiveHoursStart, Update/ActiveHoursEnd, and ShareCartPC, it will defer all the update processes (scan, download, install, and reboot) to a time after Active Hours. After a buffer period after ActiveHoursEnd, the device will wake up several times to complete the processes. All processes are blocked before ActiveHoursStart.

ADMX Info:

  • GP English name: Update Power Policy for Cart Restarts
  • GP name: SetEDURestart
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 - not configured
  • 1 - configured

Update/SetProxyBehaviorForUpdateDetection

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents.

This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security.

ADMX Info:

  • GP English name: Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service
  • GP name: Select the proxy behavior
  • GP element: Select the proxy behavior
  • GP path: Windows Components/Windows Update/Specify intranet Microsoft update service location
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • 0 (default) - Allow system proxy only for HTTP scans.
  • 1 - Allow user proxy to be used as a fallback if detection using system proxy fails.

Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure.

Update/TargetReleaseVersion

Windows Edition Supported? Home cross mark Pro check mark4 Business check mark4 Enterprise check mark4 Education check mark4

Scope:

  • Device

Available in Windows 10, version 1803 and later. Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see Windows 10 release information.

ADMX Info:

  • GP English name: Select the target Feature Update version
  • GP name: TargetReleaseVersion
  • GP element: TargetReleaseVersionId
  • GP path: Windows Components/Windows Update/Windows Update for Business
  • GP ADMX file name: WindowsUpdate.admx

Value type is a string containing Windows 10 version number. For example, 1809, 1903.

Update/UpdateNotificationLevel

Windows Edition Supported? Home cross mark Pro check mark5 Business check mark5 Enterprise check mark5 Education check mark5

Scope:

  • Device

Display options for update notifications. This policy allows you to define what Windows Update notifications users see. This policy doesn't control how and when updates are downloaded and installed.

Options:

  • 0 (default) – Use the default Windows Update notifications
  • 1 – Turn off all notifications, excluding restart warnings
  • 2 – Turn off all notifications, including restart warnings

Important

If you choose not to get update notifications and also define other Group policies so that devices aren't automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk.

ADMX Info:

  • GP English name: Display options for update notifications
  • GP name: UpdateNotificationLevel
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Update/UpdateServiceUrl

Windows Edition Supported? Home cross mark Pro check mark Business check mark Enterprise check mark Education check mark

Scope:

  • Device

Important

Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Mobile.

Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet.

Supported operations are Get and Replace.

ADMX Info:

  • GP English name: Specify intranet Microsoft update service location
  • GP name: CorpWuURL
  • GP element: CorpWUURL_Name
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

The following list shows the supported values:

  • Not configured. The device checks for updates from Microsoft Update.
  • Set to a URL, such as http://abcd-srv:8530. The device checks for updates from the WSUS server at the specified URL.

Example

<Replace>
    <CmdID>$CmdID$</CmdID>
    <Item>
        <Meta>
            <Format>chr</Format>
            <Type>text/plain</Type>
        </Meta>
        <Target>
            <LocURI>./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl</LocURI>
        </Target>
        <Data>http://abcd-srv:8530</Data>
    </Item>
</Replace>

Update/UpdateServiceUrlAlternate

Windows Edition Supported? Home cross mark Pro check mark1 Business check mark1 Enterprise check mark1 Education check mark1

Scope:

  • Device

Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.

This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.

To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server.

Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.

If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect.
If the "Alternate Download Server" Group Policy is not set, it will use the WSUS server by default to download updates.
This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.

ADMX Info:

  • GP English name: Specify intranet Microsoft update service location
  • GP name: CorpWuURL
  • GP element: CorpWUContentHost_Name
  • GP path: Windows Components/Windows Update
  • GP ADMX file name: WindowsUpdate.admx

Footnotes:

  • 1 - Available in Windows 10, version 1607.
  • 2 - Available in Windows 10, version 1703.
  • 3 - Available in Windows 10, version 1709.
  • 4 - Available in Windows 10, version 1803.
  • 5 - Available in Windows 10, version 1809.
  • 6 - Available in Windows 10, version 1903.
  • 7 - Available in Windows 10, version 1909.
  • 8 - Available in Windows 10, version 2004.

Is this page helpful?


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK