Windows Server 2022 forced an update and restart the server even though this is not allowed by registry. KB5031364

Question

Hello,

My server has blocked by registry entries to be automatic updated or restarted automatically after updates. However this KB5031364 seems to have bypassed all this and just update and restart my server.... Does anyone experience something similar? this is very concerning

Answer 1

Hello Is the server connected to internet directly or updated from wsus? Windows update has changed a lot for Windows 10 (The same for Windows server version). The "Turn off automatic update" policy may not work sometimes. We could check the windows update log to verify how the update was triggerred. Open administrator powershell command line then run "get-windowsupdatelog". The windows update will be converted automatically and saved on the desktop. The windows event log (Event Viewer\Applications and Services\Microsoft\Windows\Windowsupdateclient) should give us the time when the update was downloaded. Then check the windows update log for the detailed information. This is the general suggestions to verify the update process and it may be a little complicated. If we want to get the reason, we may open a profession ticket for more resources to check the issue. If we just want to disable Windows update, we could try to disable Windows update service from the service control panel (services.msc). In addition, you could try to run administrator command line and run the following command: reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUServer /t REG_SZ /d .. /f reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v WUStatusServer /t REG_SZ /d .. /f reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer /t REG_DWORD /d 1 /f reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f These registry keys is used to redirect the server to update from an unknown wsus server. If you want to restore the update in the future, just remove these registry keys. Best Regards, Wesley Li

If the Answer is helpful, please click "Accept Answer" and upvote it.