Configuring update on win10/pro

Topic

New Reply

I’m trying to get my new win10/pro {1809}system configured and I have been thoroughly warned to disable automatic updates but I am not sure how to make that happen.   I find lots of sites with ‘how to’s and they’re all different and all seem to be aimed at win10/home.   What should I do?  I’ve read about being able to “pause” updates for a week, but I’ve looked everywhere and I have no such setting [at least none that I can find].

I’ve been looking at the group policy editor for windows-update and that looks like a likely, but potentially dangerous place to mess around.  they are *all* “Not configured”.   I see one that looks promising: “Configure Automatic Updates”.  As all the other policies it is neither enabled or disabled,k but just “not configured”.     I see that it has a setting:

———————————————
3 = (Default setting) Download the updates automatically and notify when they are ready to be installed

Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them.

—————————————–

This sounds like it handles updates to make them work just like in win7.   If so, why so many odd things [the ‘pause’ that I can’t find, messing with metered downloading, or the BITS service or …]???    Is the only thing i have to do to get control over updates is to configure/enable this policy and leave it at its default [3]?

 

Reply | Quote

Replies

Settings/Updates & Security/Windows Update/Advanced Settings

Delivery Optimization

Group Policy

6 users thanked author for this post.

Elly, jburk07, lmacri, Dan Montague, mirkec, taftbaby

Reply | Quote

Explanation – In Advanced Options
SAC – gives you Patch Tuesday Security Cumulative Updates (no Previews which are meant for testing).
Defer Feature Updates = 365 holds off UPGRADES for 365. This can be set wherever you want. I set it at 365, then I can choose when to upgrade by lowering the number when I’m ready
Defer Quality Updates = 0 allows Monthly CUs to be seen immediately after release. I set this to zero, b/c I want to be able to see what’s out there. If you set this to a number, the updates do not show up in the queue for that many days.
No Pause – if you pause updates, at the end of the pause whatever is out there installs (whether you want it or not).

Delivery Optimization
If you set this your network it’s OK, but you probably don’t want updates coming to your PC from any PC out on the Internet

Group Policy
Windows Update = Enabled, value = 2 (notify download/install)
This prevents the updates from downloading to your PC until you click on download. If the updates are not on your computer, they can’t install. Quality updates deferral = 0 allows you to SEE the pending updates so you know what to hide if you don’t want it. But they do not download automatically.

Use wushowhide to HIDE the updates you don’t want and the procedure in our Knowledge Base AKB2000013 to clear the Windows Update queue of the updates you hide.

11 users thanked author for this post.

Grond, Cato, opti1, jburk07, lmacri, Dan Montague, Great Lake Bunyip, Microfix, Seattle27, berniec

Reply | Quote

PK, after doing the changes to group policy and services how do you actually do download and install? Click check for updates or ? Thanks for any info!

Reply | Quote

Follow the procedure in AKB2000013 (linked above) Once you clear the WU queue and verify after reboot that only the things you want are pending, “Check for updates” is safe. Or you can wait 24 hours after clearing the queue until your computer automatically runs WU again (and you check for pending updates with whshowhide first!).

2 users thanked author for this post.

Dan Montague, taftbaby

Reply | Quote

PK, before downloading, do I need to undo the group policy setting? Also, I know the site was down today. Looks like we have a new sign-in page?

Reply | Quote

No, you don’t change anything in Group Policy for ordinary updating.

If you want to install Previews (not recommended, you will need to change the Channel to SAC (Targeted). If you want the next version, you will need to change the Feature deferral to a lower number. But the GP setting of 2 will give you a “Download” button and the updates don’t download until you click on it if they are showing in Windows Update.

1 user thanked author for this post.

Dan Montague

Reply | Quote

Thank You! Always appreciate the info!

Reply | Quote

berniec wrote:

I’ve read about being able to “pause” updates for a week, but I’ve looked everywhere and I have no such setting [at least none that I can find].

Unfortunately that functionality is introduced with the forthcoming 1903 version:

Many people use Sordum.org’s portable, freeware Windows Update Blocker (recently updated to v1.2 to deal with the Windows Update Medic Service, Microsoft’s recent attempt to stop you having control over the Windows Update service and related services)

Just run it, choose the Disable Service option and tick the Protect Service Settings checkbox then click on the Apply Now button… then exit WUB. Note that this will also prevent definition updates to Windows Defender, if that’s the anti-malware solution you use.

Hope this helps…

3 users thanked author for this post.

Elly, Dan Montague, woody

Reply | Quote

Strange. I’ve had “Pause” on my 1809 Pro ever since. See screenshot above.

Reply | Quote

The “Pause” in the Advanced Options page in all versions of Win10 is different from the “Pause” on the main Windows Update page introduced in 1903.

It’s confusing. I’ll be writing about it when 1903 comes out and we’re sure of the setting and what it actually does.

For now, don’t use “Pause” on 1809 or earlier machines. Use the branch selection (SAC), feature update deferral (180), and quality update deferral (15).

Delivery Optimization is a completely different can of worms. It’s been the source of many problems with corporate networks. Don’t use it.

5 users thanked author for this post.

unbob, Elly, jburk07, Dan Montague, Kirsty

Reply | Quote

Pausing updates has been available in Windows 10 Pro for more than two years, since version 1703 (and was originally 7 days only):

What’s new in the Windows 10 Creators Update Settings app

1 user thanked author for this post.

woody

Reply | Quote

PKCano wrote:

Strange. I’ve had “Pause” on my 1809 Pro ever since. See screenshot above.

You’re right. I thought the OP was talking specifically about the ‘7 day’ pause, i.e. 1903’s default pause interval without going into ‘Advanced options’.

Reply | Quote

I’m a bit confused. First, I still don’t see ‘pause’ See attached: that’s what I get when I go to “advanced” on Updates.

Second, what am i missing about the group policy: the ‘2’ setting *seems* to be exactly the win7 update discipline. What goes wrong if i just do ‘2’ and not mess with any of the other stuff. Thanks for your patience…

Reply | Quote

You don’t have the deferral settings either.
That I can’t explain.
Let me look further tomorrow.

You you can try the “2” setting in Group Policy.
That will hopefully work along with whshowhide.

BTW there is another setting in GP you may want to set – see the other “enabled” in the screenshot about excluding drivers from Windows Update.

Reply | Quote

This looks like win10 Home     whats your winver show?

3 users thanked author for this post.

CADesertRat, PKCano, b

Reply | Quote

You could also go to Settings>System>About and look at Windows Specifications.

Don't take yourself so seriously, no one else does 🙂
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).

Reply | Quote

If you have Win 10 Pro

For some reason it looks like the Pause is missing so (just a suggestion), try going to search and type cmd and in the search box when cmd shows up, right click and choose Run as Administrator. OK the box to allow and then type in chkdsk /f then enter, then type Y and then enter and close it out and reboot to see if it will fix the missing pause in advanced. It doesn’t take long so it’s worth a try. It has fixed a few installation problems for me.

Hope this helps

Don't take yourself so seriously, no one else does 🙂
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).

Reply | Quote

Thanks for the help.  I’ve got the policies fixed.   but the comments about why my /pro seems to be defective has me worried.  I checked winver:

and it is odd: on win7 it says “windows 7 professional”   This doesn’t but it does say “This Windows Pro operating system…”   also, I did have the group policy editor and had no trouble tweaking policies, and at least on win7 that only came in the non-Home versions.  So now i dunno..  But in any event I think I’m set now.

I note that patch tuesday went by and there’s no sign of any updates for my win10 system.  So I guess I’ll find out what happens when the next round of updates makes it to my system

Reply | Quote

Looks like you have Win10 Pro 1809.

You need to scroll down farther in the Advanced Settings page, and set it to look like what I describe every month in Computerworld. Here’s the latest:

https://www.computerworld.com/article/3394684/patches-are-coming-tomorrow-make-sure-windows-update-gets-locked-down.html

(PKCano’s description above is entirely accurate. You can’t one-click Pause in 1809. But you should read the Computerworld and MS-DEFCON references!) 🙂

1 user thanked author for this post.

Elly

Reply | Quote

berniec wrote:

I note that patch tuesday went by and there’s no sign of any updates for my win10 system

Go to Windows update history to list the latest updates installed (just type in search box : update history.

Reply | Quote

(Facepalm. Ouch.)

I apologize. I’ve had a lot on my plate lately, but that’s no excuse. @berniec please forgive me for handing you a stock answer when I should’ve been looking at the evidence you provided.

On reflection (thx, @PKCano), here’s what I see. You have Win10 Pro 1809. In the Windows Update settings, Advanced Options box, you do not have a section marked “Choose when updates are installed.” That seems to be the crux of the problem.

I’ve searched high and low and found several cases where “Choose when updates are installed” has gone missing. I don’t see any Group Policy setting that removes that section entirely – only policies that gray them out.

Ends up that this is a known bug in Win10 1809. On the MS Answers Forum, “Sumit (Independent Advisor)” says:

This is being reported by many that options disappear after a clean install.

Please add feedback and share the feedback with me so that I can escalate:

https://support.microsoft.com/en-in/help/27932/…

Sumit

Predictably, the Feedback Sumit refers to is just the general Feedback page. I went into Feedback (which is its own UWP app – ugh – not accessible to, or indexed by, Google Search) and found a few hits on

missing “choose when updates are installed”

but, again predictably, there’s very little there.

So here’s what I figure: Your system’s screwed up. I don’t know why. The only solution I can think of is to do a non-destructive “Reset this PC” (Start > Settings > Update & Security > Recovery) but I have no idea if that’ll work or not.

So again apologies. Please keep us updated on your results!

2 users thanked author for this post.

Dan Montague, Elly

Reply | Quote

AHA!! I think I’ve discovered my problem. In the ComputerWorld article you say to run settings>Update as *administrator*. I *never* run as administrator and so what I see [and showed you all] is what the non-admin user sees. I just switched to my admin account and sure enough: there are a *ton* of settings for update, including, I expect now I can do the settings that everyone has recommended.

I also see that when I check the settings [either admin or non] it warns me that “your organization has set some policies to manage updates. I thought i only tweaked two, but it lists three: Notify to download updates, Exclude Drivers and Set automatic update options.

Also, at least for now the options seem to be just right: I got a notification that there was an update pending: it was a defender update and just like in win7 I got to *tell* win10 to do the update. YAY!

Side question that doesn’t really matter but since I rarely [read “essentially never”] run as admin, I’m wondering; it is possible to get UAC to let me get to settings>Update? I couldn’t find a way.

Thanks! … off to set the admin options on update… /b\

4 users thanked author for this post.

Elly, CADesertRat, woody, b

Reply | Quote

When you make changes in Group Policy, you will get the “your organization has set some policies to manage updates” at the top of the Windows Update screen. It is a warning/list of the changes made in GP.

2 users thanked author for this post.

Dan Montague, woody

Reply | Quote

ACH! Yes, absolutely, you’re quite correct.

Reply | Quote

On the 1903 ver does use of the ‘pause’ cause a forced update when the pause period ends as the one is 1803?

🍻

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

Yes:

“… and then you have to update.”

https://www.howtogeek.com/fyi/windows-10-home-will-finally-let-you-pause-updates/

2 users thanked author for this post.

wavy, woody

Reply | Quote

berniec wrote:

AHA!! I think I’ve discovered my problem. In the ComputerWorld article you say to run settings>Update as *administrator*. I *never* run as administrator and so what I see [and showed you all] is what the non-admin user sees. I just switched to my admin account and sure enough: there are a *ton* of settings for update, including, I expect now I can do the settings that everyone has recommended.

So, as a VERY new Win10 (Pro) user, still going through initial set up, this inspires me to ask:  when working with Windows Update should we always be logged on to an administrator account rather than to a standard account elevated with administrator password?

With Win7 HP I always did everything that required administrator privileges while logged on to my standard account elevated with the administrator password unless specifically instructed to do otherwise.

Thanks!

Reply | Quote

opti1 wrote:

when working with Windows Update should we always be logged on to an administrator account rather than to a standard account elevated with administrator password?

Yes.

2 users thanked author for this post.

Dan Montague, opti1

Reply | Quote

I am new to Windows 10 and on my new Windows 10 Pro version 1909 computer, not too long after February update, I have set the number of the quality update can be deferred to 30 with the thought that when the green light is given I will change the deferred day to 0 day, restart the computer and wait for the system to install the March update. If I want to use the Group Policy (#2) do I have to wait till after the March monthly updates are installed then make the switch, to use the Group Policy (#2), or can I do it now? If I can do it now, could you please show me step by step on how to do it?
Thanks!

Reply | Quote

You do not have to wait to set the “2” in Group Policy.
There is a guide to Windows Update settings in AKB2000016, with illustrations of how to set Group Policy. You might want to read through it to see how all the settings work.

1 user thanked author for this post.

Elly

Reply | Quote

Thanks for your response. What concerns me is that in order to use the Group Policy (#2) I have to first change the Quality Update Deferral day from 30 day to 0 day and in restart the computer, and in the process of restarting the system will notice the change and start to download the March Update. However, I will read the AKB000016 again as you have suggested.

Reply | Quote

No, you do not have to change the Quality deferral to 0. Just leave it at 30 for now. After it is time and the March updates are done, that is the time to change the settings.
You don’t need to take the chance that changing the setting will precipitate download/install.
Be patient, grasshopper!

Reply | Quote

No problem, I will wait after the March updates are installed to do the change. Thanks for helping I really appreciate.

Reply | Quote