Current method to disable Windows Update in Windows 10 21H2

1

We prefer to manage all our windows updates using BigFix on a schedule that we determine. We do not want any updating to occur automagically from Microsoft at undetermined times. In the last few months we have had a few clients spontaneously update themselves. This didn’t used to happen.

We have Computer Configuration | Policies | Administrative Templates | Windows Components | Windows Update | Configure Automatic Updates set to Disabled.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate = 1

Obviously Microsoft has changed something, and the old method no longer works. Can someone enlighten us as to a currently working method to disable Windows Update on 21H2 so we can manage updates through BigFix?

1 Like
2

Windows Update does seem to have become more aggressive, although MS will say that Windows 10 have done this since 1607.

The policy settings below do seem to help to tame WU

Policy Path: Computer Configuration\Administrative Templates\Windows Component\Window Update
Policy Name: Specify intranet Microsoft update service location
Setting: Enabled (and just configure an incorrect URL, such as “…” so updates connot be found)

Policy Name: Remove access to use all Windows Update Features.
Setting: Enabled

Policy Name: Configure Automatic Updates
Setting: Disable

Policy Name: Do not allow update deferral policies to cause scans against Windows Update
Setting: Enabled

Policy Path: Computer Configuration\Administrative Templates\System
Policy Name: Specify settings for optional component installation and component repair
Setting: Enabled

3 Likes
3

Thanks, we will try that. If anyone else has additional settings or additional ideas, we’d welcome them.

4

Re-read the post.

I use BigFix to set the regkeys instead of relying on GPO:
if {x64 of operating system}

waithidden reg add “HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU” /v NoAutoUpdate /t REG_DWORD /d 1 /f /reg:64

else

waithidden reg add “HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU” /v NoAutoUpdate /t REG_DWORD /d 1 /f

endif