Configure Automatic Updates using Registry Editor

 

Updated: July 19, 2011

Applies To: Windows Server Update Services, Windows Small Business Server 2011 Standard, Windows Server 2008 R2, Windows Server 2003 with SP2, Windows Server 2008 R2 with SP1

If you do not want to use Group Policy to manage Automatic Updates (for example, the WSUS deployment is in a non-Active Directory environment), you can configure Automatic Updates by using Registry Editor.

System_CAPS_ICON_warning.jpg Warning

Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Registry entries that you can use to configure Automatic Updates by using Registry Editor are located in the following subkeys:

  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

  • HKEY_LOCAL_MACHINE\SYSTEM\Internet Communication Management\Internet Communication

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU

Registry keys for Windows Update

WSUS registry entries for Windows Update are located in the following subkey:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate

The keys and their values are listed in the following table.

Entry nameData typeValues
AcceptTrustedPublisherCertsReg_DWORDRange = 1|0

- 1 = Enabled. The WSUS server distributes available signed non-Microsoft updates.
- 0 = Disabled. The WSUS server does not distribute available signed non-Microsoft updates.
DisableWindowsUpdateAccessReg_DWORDRange = 1|0

- 1 = Disables access to Windows Update.
- 0 = Enables access to Windows Update.
ElevateNonAdminsReg_DWORDRange = 1|0

- 1 = All members of the Users security group can approve or disapprove updates.
- 0 = Only members of the Administrators security group can approve or disapprove updates.
TargetGroupReg_SZName of the computer group to which the computer belongs. This policy is paired with TargetGroupEnabled.
TargetGroupEnabledReg_DWORDRange = 1|0

- 1 = Use client-side targeting.
- 0 = Do not use client-side targeting. This policy is paired with TargetGroup.
WUServerReg_SZHTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). This policy is paired with WUStatusServer, and both keys must be set to the same value to be valid.
WUStatusServerReg_SZThe HTTP(S) URL of the server to which reporting information is sent for client computers that use the WSUS server that is configured by the WUServer key. This policy is paired with WUServer, and both keys must be set to the same value to be valid.

WSUS registry keys for Internet Explorer

WSUS registry entries for Internet Explorer are located in the following subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

The keys and their values are listed in the following table.

Entry nameData typeCorresponding Group Policy settingValues
NoWindowsUpdateReg_DWORDRemove links and access to Windows UpdatePrevents users from connecting to the Windows Update website.

Range = 1|0

- 1 = Enabled. Users cannot connect to the Windows Update website.
- 0 = Disabled or not configured. Users can connect to the Windows Update website.

WSUS registry keys for Internet communication

WSUS registry entries for Internet communication are located in the following subkey:

HKEY_LOCAL_MACHINE\SYSTEM\Internet Communication Management\Internet Communication

The keys and their values are listed in the following table.

Entry nameData typeCorresponding Group Policy settingValues
DisableWindowsUpdateAccessReg_DWORDTurn off access to all Windows Update featuresRemove all access to Windows Update.

Range = 1|0

- 1 = Enabled. All Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This setting also prevents Device Manager from automatically installing driver updates from the Windows Update website.
- 0 = Disabled or not configured. Users will be able to access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update.

WSUS registry key for Windows Update

WSUS registry entry for Windows Update is located in the following subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

The key and its value is listed in the following table.

Entry nameData typeCorresponding Group Policy settingValues
DisableWindowsUpdateAccessReg_DWORDRemove access to use all Windows Update featuresPrevents users from connecting to the Windows Update website.

Range = 1|0

- 1 = Enabled. All Windows Update features are removed.
- 0 = Disabled or not configured. All Windows Update features are available.

Registry keys for Automatic Update configuration options

The registry entries for Automatic Update configuration options are located in the following subkey:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU

The keys and their values are listed in the following table.

Entry nameData typeValues
AUOptionsReg_DWORDRange = 2|3|4|5

- 2 = Notify before download.
- 3 = Automatically download and notify of installation.
- 4 = Automatically download and schedule installation. Only valid if values exist for ScheduledInstallDay and ScheduledInstallTime.
- 5 = Automatic Updates is required and users can configure it.
AutoInstallMinorUpdatesReg_DWORDRange = 0|1

- 0 = Treat minor updates like other updates.
- 1 = Silently install minor updates.
DetectionFrequencyReg_DWORDRange = n, where n = time in hours (1–22).

- Time between detection cycles.
DetectionFrequencyEnabledReg_DWORDRange = 0|1

- 1 = Enable detection frequency.
- 0 = Disable custom detection frequency (use default value of 22 hours).
NoAutoRebootWithLoggedOnUsersReg_DWORDRange = 0|1

- 1 = Logged-on user can decide whether to restart the client computer.
- 0 = Automatic Updates notifies the user that the computer will restart in 15 minutes.
NoAutoUpdateReg_DWORDRange = 0|1

- 0 = Enable Automatic Updates.
- 1 = Disable Automatic Updates.
RebootRelaunchTimeoutReg_DWORDRange = n, where n = time in minutes (1–1,440).

- Time between prompts for a scheduled restart.
RebootRelaunchTimeoutEnabledReg_DWORDRange = 0|1

- 1 = Enable RebootRelaunchTimeout.
- 0 = Disable custom RebootRelaunchTimeout(use default value of 10 minutes).
RebootWarningTimeoutReg_DWORDRange = n, where n = time in minutes (1–30).

- Length, in minutes, of the restart warning countdown after updates have been installed that have a deadline or scheduled updates.
RebootWarningTimeoutEnabledReg_DWORDRange = 0|1

- 1 = Enable RebootWarningTimeout.
- 0 = Disable custom RebootWarningTimeout (use default value of 5 minutes).
RescheduleWaitTimeReg_DWORDRange = n, where n = time in minutes (1–60).

- Time in minutes that Automatic Updates waits at startup before it applies updates from a missed scheduled installation time.
- This policy applies only to scheduled installations, not to deadlines. Updates with deadlines that have expired should always be installed as soon as possible.
RescheduleWaitTimeEnabledReg_DWORDRange = 0|1

- 1 = Enable RescheduleWaitTime .
- 0 = Disable RescheduleWaitTime (attempt the missed installation during the next scheduled installation time).
ScheduledInstallDayReg_DWORDRange = 0|1|2|3|4|5|6|7

- 0 = Every day.
- 1 through 7 = the days of the week from Sunday (1) to Saturday (7).
(Only valid if AUOptions = 4.)
ScheduledInstallTimeReg_DWORDRange = n, where n = the time of day in 24-hour format (0–23).
UseWUServerReg_DWORDRange = 0|1

- 1 = The computer gets its updates from a WSUS server.
- 0 = The computer gets its updates from Microsoft Update.
- The WUServer value is not respected unless this key is set.

Plan Automatic Updates Settings
Configure Automatic Updates using Group Policy

Show: