This policy is used to manage Windows Software Update settings on the device. It allows IT administrators to control how Windows updates are downloaded, installed, scheduled, and presented to end users. This Windows policy can be used for BYOD or company-owned devices.

Supported platforms: Windows
​Minimum system requirements: Windows 10+
​Ownership: Company-owned, BYOD

Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. It is specific to desktop and local publishing via WSUS for third-party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.

This policy setting allows you to configure Automatic Maintenance wake up policy. The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note that if the OS power wake policy is explicitly disabled, then this setting has no effect.

Enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. If you set 0, Windows Update won't alter its behavior.

Feature updates include security, quality revisions, and significant feature changes and are released when available.

Enable this policy to specify when to receive quality updates. You can defer receiving quality updates for up to 30 days. To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. If you set 0, Windows Update won't alter its behavior.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Specifies that a Windows Update for Business device should skip safeguards. Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience. Safeguard holds protection is provided by default to all devices trying to update to a new Windows 10 Feature Update version via Windows Update.

Enable this policy to not include drivers with Windows quality updates. If you disable or don't configure this policy, Windows Update will include updates that have a Driver classification.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Enable this policy to manage which updates you receive prior to the update being released to the world.

Specify when to receive Feature Updates.

To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared.

Feature updates include security, quality revisions, and significant feature changes and are released when available.

Specifies the date and time when the IT admin wants to start pausing the Feature Updates.

Feature updates include security, quality revisions, and significant feature changes and are released when available.

Enable this policy to specify when to receive quality updates. You can defer receiving quality updates for up to 30 days.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Specifies the date and time when the IT admin wants to start pausing the Quality Updates.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Enter the product and version as listed on the Windows Update target version page: aka.ms/WindowsTargetVersioninfo. If you enter an invalid value, you'll remain on your current version until you correct the values to a supported product and version.

Enter the product and version as listed on the Windows Update target version page: aka.ms/WindowsTargetVersioninfo. If you enter an invalid value, you'll remain on your current version until you correct the values to a supported product and version.

If you enable this policy, the PC won't automatically restart after updates during active hours. The PC will attempt to restart outside of active hours.

Enable this policy to specify the maximum number of hours from the start time that users can set their active hours. The max active hours range can be set between 8 and 18 hours. If you disable or don't configure this policy, the default max active hours range will be used.

If you enable this policy, the PC won't automatically restart after updates during active hours. The PC will attempt to restart outside of active hours. Note that the PC must restart for certain updates to take effect. If you disable or don't configure this policy and have no other reboot group policies, the user-selected active hours will be in effect.

Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.

Specifies whether this computer will receive optional updates through the Windows automatic updating service.

Enabling this policy will automatically download updates, even over metered data connections (charges may apply).

Number of days before feature updates are installed on devices automatically regardless of active hours. Before the deadline passes, users will be able to schedule restarts, and automatic restarts can happen outside of active hours. When set to 0, updates will download and install immediately, but might not finish within the day due to device availability and network connectivity.

Feature updates include security, quality revisions, and significant feature changes and are released when available.

Number of days before quality updates are installed on devices automatically regardless of active hours. Before the deadline passes, users will be able to schedule restarts, and automatic restarts can happen outside of active hours. When set to 0, updates will download and install immediately, but might not finish within the day due to device availability and network connectivity.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Minimum number of days from update installation until restarts occur automatically for quality updates. This policy only takes effect when Configure Deadline For Quality Updates is configured. If that policy is configured but this one is not, the default value of 2 days will take effect.

Quality updates (OS updates) include security, critical, and driver updates and are released monthly.

Minimum number of days from update installation until restarts occur automatically for feature updates. This policy only takes effect when Configure Deadline For Feature Updates is configured. If that policy is configured but this one is not, then the value configured by Configure Deadline Grace Period will be used. If that is also not configured, the default value of 7 days will take effect.

Feature updates include security, quality revisions, and significant feature changes and are released when available.

When this option is enabled, devices will not restart automatically outside of active hours until both the update deadline and the grace period have passed — even if an update is ready to install.

When disabled, a device may automatically restart outside of active hours as soon as an update is ready, without waiting for the deadline.

This setting only takes effect if either Configure Deadline for Quality Updates or Configure Deadline for Feature Updates is already configured.

This policy allows you to suppress Windows Update notifications during active hours. This policy doesn't control how and when updates are downloaded and installed.

This policy allows you to define what Windows Update notifications users see. This policy doesn't control how and when updates are downloaded and installed.

Specifies the day on which the computer will install security updates and other important downloads through the Windows automatic updating service.

Specifies the time at which the computer will install security updates and other important downloads through the Windows automatic updating service.

Enables weekly scheduled installation of security updates and other important downloads.

Enables scheduled installation during the first week of the month.

Enables scheduled installation during the second week of the month.

Enables scheduled installation during the third week of the month.

Enables scheduled installation during the fourth week of the month.

This setting allows you to remove access to the "Pause updates" feature for end users.

This setting allows you to remove access to scan Windows Update. If you enable this setting, user access to Windows Update scan, download, and install is removed.

Enabling this policy for EDU devices that remain on carts overnight will skip power checks to ensure update reboots will happen at the scheduled install time.