Block users from installing updates on Server 2019

Question

I have a Windows Server 2019 providing RDS for users on thin clients. I recently discovered that any user (even without admin rights) can click Start - Settings - Update & Security and trigger download and install of updates. To make matters worse, the Event Log doesn't even appear to record which user triggered the update process. How do I restrict this to administrators only.

Answer 1

You can follow along here.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/deployment/block-user-access-windows-update

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Thank you for the quick reply DSPatrick but unfortunately that will not work for my situation. The GP setting referenced in the article disables Windows Update for all users - including administrators. Please let me know if you have any other thoughts.

Answer 3

It really should not be an issue since any background update scans, downloads and installations will continue to work as configured.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Thanks again for the quick reply. Unfortunately this server is so delicate we have to patch it manually. As an example, the 2021-09 CU broke about half the web apps but had no impact on any of our other servers. Sounds like I'll have to use that GP settings to disable WU and then temporarily disable it when I need to do manual patching. Again, thank you for all your help.

Answer 5

A couple of other option are to stand up your own WSUS for complete control of what updates and when they get applied. You could also disable the Windows Update service which users would have no control over, then just Enable it again when you wanted to patch.