Windows Update and users type

Balubeto · Sep 15, 2023

Hi

I have Windows 11 23H2 Enterprise

How do I disable Windows Update updates for all accounts except those in the Administrators group?

Thanks

Bye

garlin · Sep 15, 2023

Change the Group Policy:

Enable or Disable Check for Windows Updates in Windows 10

How to Enable or Disable Check for Windows Updates in Windows 10

www.tenforums.com

Balubeto · Sep 16, 2023

garlin said:
Change the Group Policy:

Enable or Disable Check for Windows Updates in Windows 10

How to Enable or Disable Check for Windows Updates in Windows 10

www.tenforums.com

Maybe you didn't understand:

My purpose would be to enable the use of the Windows Update service only for the users belonging to the Administrators group so that Windows 11 can download the updates only when one of these users is logged in.

Now, do you understand?

Thanks

Bye

garlin · Sep 16, 2023

That is the same policy for blocking non-Admin users from triggering an update. It's right in the tutorial:

You must be signed in as an administrator to be able to enable or disable check for updates.

If you're expecting to block WU from running when no user is logged in (Admin or non-Admin) then you should disable automatic updates at the same time.

BruceR · Sep 16, 2023

garlin said:
That is the same policy for blocking non-Admin users from triggering an update. It's right in the tutorial:

That line is about who can make the policy change, not who can run updates.

garlin · Sep 16, 2023

Update Policy CSP

Learn more about the Update Area in Policy CSP.

learn.microsoft.com

SetDisableUXWUAccess

Scope Editions Applicable OS
Device
User Pro
Enterprise
Education
Windows SE
IoT Enterprise / IoT Enterprise LTSC Windows 10, version 1809 [10.0.17763] and later

Device
./Device/Vendor/MSFT/Policy/Config/Update/SetDisableUXWUAccess

This setting allows you to remove access to scan Windows Update.

If you enable this setting user access to Windows Update scan, download and install is removed.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Disabled.
1 Enabled.

Group policy mapping:

Name Value
Name DisableUXWUAccess
Friendly Name Remove access to use all Windows Update features
Location Computer Configuration
Path Windows Components > Windows Update > Manage end user experience
Registry Key Name Software\Policies\Microsoft\Windows\WindowsUpdate
Registry Value Name SetDisableUXWUAccess
ADMX File Name WindowsUpdate.admx

BruceR · Sep 16, 2023

garlin said:
Update Policy CSP

Learn more about the Update Area in Policy CSP.

learn.microsoft.com

Doesn't just block non-admin users from using check for updates.

garlin · Sep 17, 2023

I finally worked out a different answer by using System Settings page visibility to hide WU's features, and enforced by a local policy on the Non-Administrators users group.

1. Visit the Security Compliance Toolkit page, and click Download. Only select the LGPO.zip file.
2. Extract the LGPO.exe file.
3. Extract the included ZIP file in the same folder as LGPO.exe

Never install a random Policy file from someone you don't trust.

To verify Registry.pol's contents, run this command:
LGPO.exe /parse /un Registry.pol

Code:

; ----------------------------------------------------------------------
; PARSING User:Non-Administrators POLICY
; Source file:  Registry.pol

User:Non-Administrators
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
SettingsPageVisibility
SZ:hide:windowsupdate

User:Non-Administrators
Software\Policies\Microsoft\Windows\Safer
*
CREATEKEY

; PARSING COMPLETED.
; ----------------------------------------------------------------------

4. LGPO.exe /un Registry.pol

garlin · Sep 18, 2023

Have you tested it?

Balubeto · Sep 19, 2023

Another detail:

If I wanted that only users belonging to the Administrators group could download the updates from Windows Update and update the system, how could I do that?

Thanks

Bye

Windows Update and users type

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

SetDisableUXWUAccess​

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Active member

My Computer

Similar threads

SetDisableUXWUAccess