How to change your Automatic Updates settings by using Windows Security Center

INTRODUCTION

Windows Security Center is the centralized location in Windows XP Service Pack 2 where users can learn about security and can perform security-related tasks. Security Center monitors the status of three major security functions: the firewall, Automatic Updates, and virus detection. If Security Center detects a problem with any one of these, it displays an icon and balloon message in the notification area.

By default, Windows checks to make sure that Automatic Updates is set to download and install security and other important updates to your computer automatically. If Automatic Updates is turned off, or if Automatic Updates is not set to the highest setting, Security Center provides recommendations to turn on or to adjust Automatic Updates.

More Information

To have us turn on Automatic Updates for you, go to the «Fix it for me» section. If you would rather turn on Automatic Updates yourself, go to the «Let me fix it myself» section.

Fix it for me

To fix this problem automatically, click the Fix this problem link. Then click Run in the File Download dialog box, and follow the steps in this wizard.

Turn Automatic Updates on

Turn Automatic Updates off

Note This wizard may be in English only; however, the automatic fix also works for other language versions of Windows.

Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD, and then you can run it on the computer that has the problem.

Let me fix it myself

To turn on Automatic Updates yourself, follow these steps:

Click Start, click Run, type wscui.cpl, and then click OK.

Click Automatic Updates.

The following options are available:

Automatic (recommended)
This option lets you select the day and the time that updates are automatically downloaded and installed. This can be every day, or it can be on a specific day and time.

Download updates for me, but let me choose when to install them
This option automatically downloads updates, but requires user interaction to install them.

Notify me but don’t automatically download or install them
This option notifies you that there are updates available. It requires user interaction to download them and install them.

Turn off Automatic Updates
This option disables Automatic Updates. It provides a link to the Windows Update Web site where you can manually select, download, and install updates.

Windows Update: FAQ

Note: If you’re looking for Microsoft Office update info, see Install Office updates.

In Windows 10, you decide when and how to get the latest updates to keep your device running smoothly and securely. When you update, you’ll get the latest fixes and security improvements, helping your device run efficiently and stay protected. In most cases, restarting your device completes the update. Make sure your device is plugged in when you know updates will be installed.

If other questions come up when you update Windows 10, here are some other areas that might interest you:

When you only want info about updating Windows 10, you’ll find answers to many of your questions here:

When the Windows 10 May 2020 Update is ready for your device, it will be available to download and install from the Windows Update page in Settings. Choose a time that works best for you to download the update. You’ll then need to restart your device and complete the installation. After that, your device will be running Windows 10, version 2004.

To manually check for the latest recommended updates, select Start > Settings > Update & Security > Windows Update > Windows Update .

To get help updating to the latest version of Windows 10, go to the Microsoft software download page and download the Update Assistant.

Some updates may not be available on all devices at the same time—we’re making sure updates are ready and compatible.

To stay up to date, select Start > Settings > Update & Security > Windows Update > Windows Update , and then select Check for updates.

If a feature update is available for your device, it will appear separately on the Windows Update page. To install it, select Download and install now.

Here are a few things you can try if you’re having trouble installing updates:

Make sure that your device is connected to the internet. Downloading updates requires an internet connection.

If you’re connected the internet, try to install the updates manually. Select Start > Settings > Update & Security > Windows Update > Windows Update , and then view available updates.
Check for updates

Run the Windows Update Troubleshooter. Select Start > Settings > Update & Security > Troubleshoot . Under Get up and running, select Windows Update.

The time required to download updates primarily depends on internet connection speed, network settings, and update size. Make sure your device is plugged in and connected to the internet to download updates faster.

You can’t stop updates entirely—because they help keep your device safe and secure, updates will eventually need to be installed and downloaded, regardless of your update settings. Here’s how to temporarily pause updates from being downloaded and installed. Note that after the pause limit is reached, you’ll need to install the latest updates before you can pause updates again.

In the Windows 10 November 2019 Update (version 1909) or later, or in Windows version 1809 for Pro or Enterprise, select Start > Settings > Update & Security > Windows Update . Then choose one of the following options:

Select Pause updates for 7 days.

Select Advanced options. Then, in the Pause updates section, select the drop-down menu and specify a date for updates to resume.

To finish installing an update, your device will need to restart. Windows will try to restart your device when you’re not using it. If it can’t, you’ll be asked to schedule the restart for a more convenient time. Or, you can schedule anytime by following these steps:

Select Start > Settings > Update & Security > Windows Update > Windows Update .

Select Schedule the restart and choose a time that’s convenient for you.

You can set active hours to make sure automatic restarts for updates only happen when you’re not using your device. Learn about active hours for Windows 10.

Try deleting files you don’t need, uninstalling apps you don’t use, or moving files to another drive like an external USB drive or OneDrive. For more tips on freeing up disk space, see Free up drive space in Windows 10.

We recommend keeping devices like laptops and tablets plugged in when you’re not using them. This way, if updates are installed outside active hours, your device will have enough power to complete the installation. Windows updates don’t consume more battery than other typical system processes.

An update history is available so you can see which updates were installed, and when. You can also use this list to remove specific updates, although we don’t recommend this unless it’s necessary.

Select Start > Settings > Update & Security > Windows Update > Windows Update > View update history .

For more info about what’s included in updates for Windows 10, see Windows 10 update history.

We don’t recommend that you remove any installed updates. However, if you must remove an update, you can do so in update history.

Select Start > Settings > Update & Security > Windows Update > View update history > Uninstall updates.

Select the update you want to remove, then select Uninstall.

Feature updates are typically released twice per year and include new functionality and capabilities as well as potential fixes and security updates. Quality updates are more frequent and mainly include small fixes and security updates. Windows is designed to deliver both kinds of updates to devices through Windows Update.

To double check that your device is up to date, open Settings > Update & Security > Windows Update and see your update status and available updates.

To find which version of Windows you’re running, see Which version of Windows operating system am I running?

Reserved storage is not automatically turned on by Windows in any update scenarios. It is only turned on for new devices with the Windows 10 May 2019 Update (version 1903) or later preinstalled, or devices on which a clean install was performed.

Note: If you’re looking for Microsoft Office update info, see Install Office updates.

The best way to keep Windows 8.1 up to date is to turn on automatic updates. With automatic updates, you don’t have to search for updates online or worry about missing critical fixes or device drivers for your PC. Instead, Windows Update automatically installs important updates as they become available.

To turn on automatic updates:

Open Windows Update by swiping in from the right edge of the screen (or, if you’re using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), select Settings > Change PC settings > Update and recovery > Windows Update. If you want to check for updates manually, select Check now.

Select Choose how updates get installed, and then, under Important updates, select Install updates automatically (recommended).

Under Recommended updates, select Give me recommended updates the same way I receive important updates.

Under Microsoft Update, select Give me updates for other Microsoft products when I update Windows, and then select Apply.

Click the questions below to see answers about how Windows Update keeps your device up to date.

Note: If your PC is connected to a network where updates are managed by Group Policy, you might not be able to change settings related to Windows Update. For more info, contact your organization’s technical support.

Open Windows Update by swiping in from the right edge of the screen (or, if you’re using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), select Settings > Change PC settings > Update and recovery > Windows Update. To check for updates manually, select Check now.

An update history is available so you can see which updates were installed, and when. You can also use this list to remove specific updates, although we don’t recommend this unless it’s necessary.

To see your PC’s update history, open Windows Update by swiping in from the right edge of the screen (or, if you’re using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), select Settings > Change PC settings > Update and recovery > Windows Update > View your update history.

We don’t recommend that you remove any installed updates. However, if you must remove an update, you can do so in update history.

Open Windows Update by swiping in from the right edge of the screen (or, if you’re using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), select Settings > Change PC settings > Update and recovery > Windows Update > View your update history.

Select the update you want to remove, then select Uninstall.

Here are a few things to try if you’re having problems installing updates:

Make sure that your PC is connected to the internet. Some updates can’t be installed if you’re using a metered internet connection.

If you’re connected the internet and updates aren’t installed automatically, wait a few minutes and then try to install the updates manually.

See the Fix Windows Update errors guided walkthrough to try to fix the problem.

Support for Windows 7 ended on January 14, 2020

We recommend you move to a Windows 10 PC to continue to receive security updates from Microsoft.

Click the questions below to see answers about how Windows Update keeps your device up to date.

Manage additional Windows Update settings

Applies to

Looking for consumer information? See Windows Update: FAQ

You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update (WU) on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more.

Summary of Windows Update settings

Group Policy setting	MDM setting	Supported from version
Specify Intranet Microsoft update service location	UpdateServiceUrl and UpdateServiceUrlAlternate	All
Automatic Updates Detection Frequency	DetectionFrequency	1703
Remove access to use all Windows Update features	Update/SetDisableUXWUAccess	All
Do not connect to any Windows Update Internet locations	All
Enable client-side targeting	All
Allow signed updates from an intranet Microsoft update service location	AllowNonMicrosoftSignedUpdate	All
Do not include drivers with Windows Updates	ExcludeWUDriversInQualityUpdate	1607
Configure Automatic Updates	AllowAutoUpdate	All

Additional information about settings to manage device restarts and restart notifications for updates is available on Manage device restarts after updates.

Additional settings that configure when Feature and Quality updates are received are detailed on Configure Windows Update for Business.

Scanning for updates

With Windows 10, admins have a lot of flexibility in configuring how their devices scan and receive updates.

Specify Intranet Microsoft update service location allows admins to point devices to an internal Microsoft update service location, while Do not connect to any Windows Update Internet locations gives them to option to restrict devices to just that internal update service. Automatic Updates Detection Frequency controls how frequently devices scan for updates.

You can make custom device groups that’ll work with your internal Microsoft update service by using Enable client-side targeting. You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through Allow signed updates from an intranet Microsoft update service location.

Finally, to make sure the updating experience is fully controlled by the admins, you can Remove access to use all Windows Update features for users.

For additional settings that configure when Feature and Quality updates are received, see Configure Windows Update for Business.

Specify Intranet Microsoft update service location

Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.

To use this setting in Group Policy, go to Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service.

If the setting is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. If the setting is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.

The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server.

If the «Configure Automatic Updates» policy is disabled, then this policy has no effect.

If the «Alternate Download Server» is not set, it will use the intranet update service by default to download updates.

The option to «Download files with no Url. » is only used if the «Alternate Download Server» is set.

To configure this policy with MDM, use UpdateServiceUrl and UpdateServiceUrlAlternate.

Automatic Updates detection frequency

Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is determined by using the hours specified here minus zero to twenty percent of the hours specified. For example, if this policy is used to specify a 20-hour detection frequency, then all clients to which this policy is applied will check for updates anywhere between 16 to 20 hours.

To set this setting with Group Policy, navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Update\Automatic Updates detection frequency.

If the setting is set to Enabled, Windows will check for available updates at the specified interval. If the setting is set to Disabled or Not Configured, Windows will check for available updates at the default interval of 22 hours.

The «Specify intranet Microsoft update service location» setting must be enabled for this policy to have effect.

If the «Configure Automatic Updates» policy is disabled, this policy has no effect.

To configure this policy with MDM, use DetectionFrequency.

Remove access to use all Windows Update features

By enabling the Group Policy setting under Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features, administrators can disable the «Check for updates» option for users. Any background update scans, downloads and installations will continue to work as configured.

Do not connect to any Windows Update Internet locations

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store.

Use Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations to enable this policy. When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working.

This policy applies only when the device is configured to connect to an intranet update service using the «Specify intranet Microsoft update service location» policy.

Enable client-side targeting

Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or Configuration Manager.

This Group Policy setting can be found under Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting. If the setting is set to Enabled, the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer. If the setting is set to Disabled or Not Configured, no target group information will be sent to the intranet Microsoft update service.

If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified.

This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the «Specify intranet Microsoft update service location» policy is disabled or not configured, this policy has no effect.

Allow signed updates from an intranet Microsoft update service location

This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.

To configure this setting in Group Policy, go to Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location.

If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by Specify Intranet Microsoft update service location, if they are signed by a certificate found in the «Trusted Publishers» certificate store of the local computer. If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft.

Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting.

To configure this policy with MDM, use AllowNonMicrosoftSignedUpdate.

Installing updates

To add more flexibility to the update process, settings are available to control update installation.

Configure Automatic Updates offers 4 different options for automatic update installation, while Do not include drivers with Windows Updates makes sure drivers are not installed with the rest of the received updates.

Do not include drivers with Windows Updates

Allows admins to exclude Windows Update (WU) drivers during updates.

To configure this setting in Group Policy, use Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates. Enable this policy to not include drivers with Windows quality updates. If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification.

Configure Automatic Updates

Enables the IT admin to manage automatic update behavior to scan, download, and install updates.

Configuring Automatic Updates by using Group Policy

Under Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates, you must select one of the four options:

2 — Notify for download and auto install — When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to Settings > Update & security > Windows Update, users can download and install any available updates.

3 — Auto download and notify for Install — Windows finds updates that apply to the device and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Settings > Update & security > Windows Update, users can install them.

4 — Auto download and schedule the install — Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see Schedule update installation.

5 — Allow local admin to choose setting — With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.

If this setting is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to Settings > Update & security > Windows Update.

If this setting is set to Not Configured, an administrator can still configure Automatic Updates through the settings app, under Settings > Update & security > Windows Update > Advanced options.

Configuring Automatic Updates by editing the registry

Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk.

In an environment that does not have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update.

To do this, follow these steps:

Select Start, search for «regedit», and then open Registry Editor.

Open the following registry key:

Add one of the following registry values to configure Automatic Update.

0: Automatic Updates is enabled (default).

1: Automatic Updates is disabled.

1: Keep my computer up to date is disabled in Automatic Updates.

2: Notify of download and installation.

3: Automatically download and notify of installation.

4: Automatically download and scheduled installation.

0: Every day.

1 through 7: The days of the week from Sunday (1) to Saturday (7).

n, where n equals the time of day in a 24-hour format (0-23).

Set this value to 1 to configure Automatic Updates to use a server that is running Software Update Services instead of Windows Update.

m, where m equals the time period to wait between the time Automatic Updates starts and the time that it begins installations where the scheduled times have passed. The time is set in minutes from 1 to 60, representing 1 minute to 60 minutes)

This setting only affects client behavior after the clients have updated to the SUS SP1 client version or later versions.

0 (false) or 1 (true). If set to 1, Automatic Updates does not automatically restart a computer while users are logged on.

This setting affects client behavior after the clients have updated to the SUS SP1 client version or later versions.

To use Automatic Updates with a server that is running Software Update Services, see the Deploying Microsoft Windows Server Update Services 2.0 guidance.

When you configure Automatic Updates directly by using the policy registry keys, the policy overrides the preferences that are set by the local administrative user to configure the client. If an administrator removes the registry keys at a later date, the preferences that were set by the local administrative user are used again.

To determine the WSUS server that the client computers and servers connect to for updates, add the following registry values to the registry: