WSUS GPO - Disable WU Internet Locations also disable Windows Store App Installs

Question

Hi Everyone,

Many thanks in advance!

In the company I work for, we have a GPO for WSUS where I have configured the preference setting "Do not connect to any Windows Update Internet locations" in order to avoid users from accidentally clicking the button to check for updates from internet. However, we can see this preference is also interfering with Windows Store App installs/Updates.

I am wondering if anyone has come across this before, and would be able to provide some guidance on how to proceed in order to block Windows Updates connection to Internet Locations while still allowing the Windows Store to continue to operate normally for app installs and updates.

Is there anyway that we can block updates from internet for enforcing WSUS while still keeping the Windows Store fully functional (Online App Install & Updates)?

Kind Regs,
Bruno

Answer 1

@Bruno Ramos de Matos
Thanks for your posting on Q&A.

Please consider enabling the below policy to prevent the clients from checking for updates from the Internet:

Hope the above will be helpful.

Regards,
Rita

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Set the policy " Do not connect to any Windows Update Internet locations " back to Not Configured

If you're trying to prevent users from possibly clicking the "Check for Updates" link, hide the Settings panel for Windows Update instead.

https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-settings-app-group-policy

windowsupdate-action or windowsupdate (depending on what you want to hide)

https://www.howtogeek.com/308489/how-to-hide-pages-from-windows-10s-settings-app/

Answer 3

@Adam J. Marshall , @Rita Hu -MSFT ,

​We still want to allow for the ​option to "Check for Updates" to be visible. However, we want to block/hide the other button that says "Check online for updates from Microsoft Update".

An option to block Windows Update from accessing Internet locations is acceptable, but only where it does not remove the Windows Store Online functions, such as Install/Update Apps, etc.

For reference, you can see the button we need to get rid off highlighted in the screenshot, below:

P.S.: We do have a patch orchestration system in house and our WSUS GPO has the following settings configured at the moment to allow for any approved patches to be automatically downloaded to the computers, then the patch orchestration system would get to install those at specified maintenance windows. Please, see our current WSUS GPO settings, below: