How to Configure Windows Updates Using Group Policy (GPO)

 

Managing Windows Updates through Group Policy (GPO) allows administrators to control how and when updates are applied across computers in a domain. This ensures consistency, security, and minimal disruption for end users.

This guide walks you through the steps to configure Windows Update settings using GPO on Windows Server.

1. Open the Group Policy Management Console (GPMC)

Press Windows + R, type:

gpmc.msc

1.  and press Enter.
   
    
2. In the left panel, expand your forest and domain to locate the Group Policy Objects container.
   
    

2. Create or Edit a GPO

1. Right-click Group Policy Objects and select New to create a new GPO (e.g., “Windows Update Policy”), or select an existing one and choose Edit.
   
    
2. Right-click the target GPO and select Edit. This opens the Group Policy Management Editor.
   
    

3. Navigate to Windows Update Settings

In the editor, go to:

Computer Configuration  

   → Administrative Templates  

      → Windows Components  

         → Windows Update  

4. Configure Automatic Updates

1. In the right panel, double-click Configure Automatic Updates.
   
    
2. Select Enabled.
   
    
3. Under Options, choose your preferred setting, such as:
   
    
   • 2 – Notify for download and auto install
     
      
   • 3 – Auto download and notify for install
     
      
   • 4 – Auto download and schedule the install (most common)
     
      
   • 5 – Allow local admin to choose setting
     
      
4. If you select option 4, specify a schedule (e.g., every Sunday at 3 AM).
   
    
5. Click Apply → OK.
   
    

5. Additional Recommended Settings

Consider configuring these policies under the same Windows Update section:

• Specify intranet Microsoft update service location (if using WSUS).
  
   
• Do not display ‘Install Updates and Shut Down’ option in Shut Down Windows dialog.
  
   
• Turn on recommended updates via Automatic Updates.
  
   
• No auto-restart with logged on users for scheduled automatic updates installations (prevents disruption).