"Check online for updates from Microsoft Update" missing in Windows 11 (WSUS GPO)

Question

We have migrated our first few Windows 10 installations to Windows 11. We are operating in a 2019 Active Directory and we use GPOs for WSUS.
Our GPO provides a local WSUS server, but it also allows Updates from Microsoft.

I have observed that this blue link saying Check online for updates from Microsoft Update is entirely missing from Windows 11 update settings.
I am not very happy anyway with the approach MS takes, automating this update mechanism more and more, not even in Windows Server OS it's possible anymore, like it was with Windows 2021 R2, to deselect updates or such things. This whole procedure meanwhile is a take it ar leave it approach.
However, this Check online for updates from Microsoft Update was very handy, if some updates didn't arrive yet on our WSUS, or by some missing config they did not load to WSUS etc. Is there any chance to get this feature enabled?

Also, what happens if one has no connection to it's WSUS (no VPN) for quite a while, is there any chance to get updates directly online form MS?

Cheers,
Dieter

Answer 1

Hi @Anonymous - I was experiencing what appears the same issue as you were on my win10 enterprise managed setup that i joined to insider program one month before win11 released in order to upgrade early and dogfood for any issues.

From that point up until and after rtm I lost access to the “check online for updates from microsoft update” link that normally displays just under the “check for updates [ from my enterprise IT managed wsus ]” button.

To work around this I was having to remove my enterprise IT [sc]cm client install in order to make the "check for updates" button revert to using microsoft update instead of my enterprise IT managed wsus so that I could pull win11 updates prior to rtm and cumulative updates after rtm. Not a viable long term solution as i want / need both options.

Coincidentally we have just started piloting the w365 cloud pc SaaS service and that team enabled me with a win11 enterprise managed cloud pc setup where i was seeing the expected and desired “check online for updates from microsoft update” link displayed just under the “check for updates [ from my enterprise IT managed wsus ]” button.

I compared my hklm\Software\Policies\Microsoft\Windows\WindowsUpdate key on that w365 cloud pc win11 setup, where I do see expected “check online for updates from microsoft update” link in addition to “check for updates [ from my enterprise IT managed wsus ]” button. I noticed it was lacking one value than mine contained, "DoNotConnectToWindowsUpdateInternetLocations"=dword:00000000.

I deleted that registry value and revisited windows update screen and now I am setting the expected “check online for updates from microsoft update” link just below the “check for updates [ from my enterprise IT managed wsus ]” button and when i click it i appear to be getting the expected functionality. This would suggest the presence of "DoNotConnectToWindowsUpdateInternetLocations" is being interpreted as 0x1 and ignoring what value data settings of 0x0.

Answer 2

Hi Team,

Will ,Check for online updates , affect WSUS server or that break the system like optional updates? Please need some clarity, I am not sure if we need to check both "check for updates" and Check for online updates" in W11? Please clarify

Answer 3

honestly, I also thought to try that, but then I somehow forgot about it :D

Answer 4

A colleague detected, that the link appears if the value of the registry key will be set to 1. In other words, we found a bug. Win 11 interprets this value in direct opposite direction like Win10. Somebody at Microsoft don't understand what is on or off in binary values...

Answer 5

Found it. This registry key will be controlled by the policy "Do not connect to any Windows Update Internet locations".

https://gpsearch.azurewebsites.net/#10875

In our environment this policy is explicitly set to disabled. This creates the registry key in question with the value "0", I think. The key exists on Windows 10 too, but has not the same effect like on Windows 11.

I will create a GPO for W11 where this policy is set to "not configured". Let's see.