Keeping Updates On¶
An image can have updates disabled, paused, or deferred in ways the Settings page doesn't make obvious. Check all four.
1. The service¶
Get-Service wuauserv | Select Status, StartType
StartType: Disabled means no updates, ever. Fix:
Set-Service wuauserv -StartupType Manual
Start-Service wuauserv
Manual is the Windows default and is fine. Automatic also works.
2. The automatic updates policy¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage end user experience → Configure Automatic Updates.
- Disabled means automatic updates are off. This is the finding.
- Enabled, option 4 - Auto download and schedule the install is right.
- Not Configured leaves the Windows default, which also updates automatically.
Registry:
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
NoAutoUpdate = 1 is the problem. Either delete it or set it to 0. If AUOptions exists it should be 4.
3. Pauses and deferrals¶
Settings → Windows Update: if it says "Updates paused," click Resume updates.
Deferrals delay patches by up to 30 days (quality updates) or a year (feature updates). gpedit.msc → Windows Update → Manage updates offered from Windows Update → Select when Quality Updates are received: Not Configured.
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
DeferQualityUpdates = 1 or PauseQualityUpdatesStartTime present means patches are being held back.
4. Policy settings the benchmark requires¶
All under gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Windows Update:
| CIS | Setting | Folder | Set to | Why |
|---|---|---|---|---|
| 18.10.94.2.1 | Configure Automatic Updates | Manage end user experience | Enabled, option 4 | Auto download and schedule the install |
| 18.10.94.2.2 | Configure Automatic Updates: Scheduled install day | Manage end user experience | 0 - Every day | Patches install the day they arrive, not next Tuesday |
| 18.10.94.1.1 | No auto-restart with logged on users for scheduled automatic updates installations | Legacy Policies | Disabled | The restart happens even if someone stays logged in |
| 18.10.94.2.4 | Remove access to "Pause updates" feature | Manage end user experience | Enabled | Users can't pause patching for 35 days |
| 18.10.94.2.3 | Enable features introduced via servicing that are off by default | Manage end user experience | Disabled | New features arrive through the normal upgrade path, not switched on mid-cycle |
| 18.10.94.4.2 | Select when Quality Updates are received | Manage updates offered from Windows Update | Enabled: 0 days | No deferral of security patches |
| 18.10.94.4.1 | Manage preview builds | Manage updates offered from Windows Update | Disabled | No Insider builds on a production machine |
| 18.10.94.4.3 | Enable optional updates | Manage updates offered from Windows Update | Disabled | Only the required updates, not optional feature previews |
Two related settings elsewhere:
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.17.1 | Download Mode | Windows Components → Delivery Optimization | Anything except Internet (3). "LAN" (1) or "Simple" (99) are fine. | Updates aren't fetched from or served to random internet peers |
| 18.10.66.2 | Turn off Automatic Download and Install of updates | Windows Components → Store | Disabled | Store apps keep updating themselves |
| 18.10.66.3 | Turn off the offer to update to the latest version of Windows | Windows Components → Store | Enabled | The Store doesn't push a Windows version upgrade |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 4 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v ScheduledInstallDay /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v SetDisablePauseUXAccess /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DeferQualityUpdates /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v ManagePreviewBuildsPolicyValue /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v AllowOptionalContent /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v DODownloadMode /t REG_DWORD /d 1 /f
5. Metered connection¶
A connection marked as metered stops updates downloading. Settings → Network & internet → Ethernet (or the Wi-Fi network) → Metered connection: Off.
Verify¶
Get-Service wuauserv | Select StartType
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DeferQualityUpdates
Service not Disabled; the two registry queries either return 0 or "unable to find the specified registry key," which means not set.
Example¶
Settings shows "You're up to date" but Get-HotFix shows nothing newer than four months ago. reg query finds NoAutoUpdate = 1. Windows wasn't checking. Delete the value, run Check for updates, and a long list appears.