Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Configure Automatic Updates

This computer-scoped Group Policy setting controls how Windows scans for, downloads, and installs available updates.

since 0.9.8.11

Purpose

Show registry keys (11)
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AutomaticMaintenanceEnabled
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallDay
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallTime
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AllowMUUpdateService
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallEveryWeek
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallFirstWeek
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallSecondWeek
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallThirdWeek
  • HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ScheduledInstallFourthWeek

This computer-scoped Group Policy setting controls how Windows scans for, downloads, and installs available updates. The listed values are components of the same policy and use the REG_DWORD data type.

NoAutoUpdate establishes the overall state:

  • 0: Automatic Updates is enabled. AUOptions determines its behavior.
  • 1: Automatic Updates is disabled. Available updates must be downloaded and installed manually.

AUOptions selects the behavior when Automatic Updates is enabled:

  • 2: Users are notified before download and can initiate the download and installation.
  • 3: Windows downloads updates automatically in the background and notifies users when the updates are ready to install.
  • 4: Windows downloads updates automatically and installs them according to the configured schedule.
  • 5: Local administrators may select the configuration mode but may not disable Automatic Updates. This option isn't available on Windows 10 or later client versions.
  • 7: Windows downloads applicable updates and notifies users both before installation and before the required restart. This option applies only to Windows Server 2016 and later.

Microsoft also documents AUOptions=1 as a legacy registry representation for disabled Automatic Updates. The Group Policy setting represents this state through NoAutoUpdate=1.

For AUOptions=4, ScheduledInstallDay and ScheduledInstallTime define the installation schedule. ScheduledInstallDay=0 means every day; values 1 through 7 represent Sunday through Saturday. ScheduledInstallTime specifies an hour from 0 through 23 in 24-hour format. The actual installation can begin within a window of approximately 30 minutes around the scheduled time.

AutomaticMaintenanceEnabled=1 represents the policy option to install updates during Automatic Maintenance. Windows then uses an appropriate maintenance opportunity instead of relying exclusively on the fixed installation time.

Notes

Additional effects

ScheduledInstallEveryWeek=1 schedules installation once each week on the day and at the time selected by ScheduledInstallDay and ScheduledInstallTime.

Alternatively, setting ScheduledInstallFirstWeek, ScheduledInstallSecondWeek, ScheduledInstallThirdWeek, or ScheduledInstallFourthWeek to 1 selects particular weeks of each month. Combined with ScheduledInstallDay, these values can represent a schedule such as the second Tuesday of the month. The four week ranges cover calendar days 1–7, 8–14, 15–21, and 22–31. They aren't mutually exclusive.

AllowMUUpdateService=1 permits scans for updates to other Microsoft products through Microsoft Update. Depending on the installed products, this can include software such as Microsoft Office and Visual Studio. The setting also includes drivers unless a separate driver-exclusion policy applies.

Security

Setting NoAutoUpdate=1 prevents automatic delivery of security updates as well as other updates. If no other process installs them promptly, known vulnerabilities remain unpatched for longer.

Notification-based modes and infrequent installation schedules can also delay patching compared with the normal automatic behavior. Their actual security impact therefore depends on whether users or other management policies ensure that offered updates are installed on time.

Enabling Microsoft Update through AllowMUUpdateService can provide security updates for additional installed Microsoft products. It also expands the set of software—and potentially drivers—that the update service may update.

Possible side effects

Automatic downloads can consume network bandwidth. Installation can temporarily affect system performance and may require a restart, interrupting running applications or services.

With a monthly schedule, an installation can be postponed until the following month if the device isn't available at the selected time. Separate update deadline policies can override the configured download, installation, or restart behavior when their deadline conditions take effect.

Notes

For this registry-backed Group Policy setting, the scheduling values apply to scheduled installation with AUOptions=4. Microsoft documents ScheduledInstallEveryWeek and the four monthly-week values for Windows 10, version 1709 and later. AllowMUUpdateService is supported starting with Windows 10, version 1607. The policy also applies to Windows 11.

Microsoft notes that changing AllowMUUpdateService back to 0 or Not configured doesn't automatically remove an already registered Microsoft Update service.

Microsoft documentation

Microsoft Learn: Manage additional Windows Update settings

Microsoft Learn: Update Policy CSP

Microsoft Learn: Update other Microsoft products

See also