Windows Update Service

Question

Windows Update Service

pavan vemula 1

Hello

Looking for windows update service registry keys and their importance

1) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
a) if we create a name: DisableWindowsUpdateAccess value:1
b) it would disable windows update service and its capabilities
2) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate/AU ( is this only related to enable or disable Auto update?)
a) here we have many options
b) noAutoUpdate Value:1 and 0

if we set above value as 1 - is that disable windows update capability not to look updates automatically - which means there should be WSUS?
or if we search for windows updates in control panel - does it look and show updates?

when we set this value as 1 - we see it throwing errors.

Please advice

Rita Hu -MSFT 9,661 Reputation points

2021-08-23T06:02:47.417+00:00

@pavan vemula
It seems that there are no updates for several days. May I know the status of the case? Is there any help I could provide?

Any updates will be appreciated. Thanks for your time.

Regards,
Rita

3 answers

Your answer

Rita Hu -MSFT 9,661 Reputation points

2021-08-23T06:02:47.417+00:00

@pavan vemula
It seems that there are no updates for several days. May I know the status of the case? Is there any help I could provide?

Any updates will be appreciated. Thanks for your time.

Regards,
Rita

Answer 1

@pavan vemula
Thanks for your posting on Q&A.

Here are some comments I want to share you:
1) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
a) if we create a name: DisableWindowsUpdateAccess value:1
b) it would disable windows update service and its capabilities

Yes. In fact, you enable the Turn off access to all Windows Update features policy on the clients and the DisableWindowsUpdateAccess value will be added to the registry. Please review the below screenshots:

2) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate/AU ( is this only related to enable or disable Auto update?)
a) here we have many options
b) noAutoUpdate Value:1 and 0

if we set above value as 1 - is that disable windows update capability not to look updates automatically - which means there should be WSUS?
or if we search for windows updates in control panel - does it look and show updates?
when we set this value as 1 - we see it throwing errors.

In fact, the noAutoUpdate value is related with Configuration Automatic Updates policy. Value 1 means that you disabled the Configuration Automatic Updates policy. However, you have enabled the clients do not access to the Windows Update. So the clients could not access any update service.

Please set the value 1 of noAutoUpdate.

Hope the above will be helpful.

Regards,
Rita

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

pavan vemula 1

Thank you
@Rita Hu -MSFT -

1) if we have enabled windows update service by not creating any Dword in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
but
2) disabled using Dword NoAutoUpdate=1 in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate/AU

we have to manually download and install any updates. Does this mean still check for updates in control panel works?

or do we need to use https://www.catalog.update.microsoft.com/Home.aspx to download KBs ?

above scenario when we look for updates (check updates option) - it giving errors HRESULT: 0x80240438 - when I set NoAutoUpdate=0 - it started working again.

need more clarity between two keys and what exactly they do. Please

Rita Hu -MSFT 9,661 Reputation points

2021-08-13T01:53:57.943+00:00
1) if we have enabled windows update service by not creating any Dword in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
but
In my opinion, the WindowsUpdate Key has been created by default and the other values will be added if we enabled the other group policies.

above scenario when we look for updates (check updates option) - it giving errors HRESULT: 0x80240438 - when I set NoAutoUpdate=0 - it started working again.
As I pointed above, the NoAutoUpdate value will be added into the registry if you disable the Configuration Automatic updates policy. Of course, we could add this value directly. It means that we could also download and install udpates manually. Here are the explanation of this value for your reference:

If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start.

or do we need to use https://www.catalog.update.microsoft.com/Home.aspx to download KBs ?
You could get updates from this site. We could also configure the other tools to deploy updates in the internal, like WSUS or MECM.

Regards,
Rita
pavan vemula 1 Reputation point

2021-08-23T17:18:30.103+00:00

Thank you @Rita Hu -MSFT

we use Windows update service to downlead and install updates across the fleet.

for now we only checking registry value - not checking AU options. Suspecting AU options also block windows update service to search and list available updates. If AU options only used for Auto updates - does not block windows update service completely. (you mean this might be the manual way of pulling updates - go to check updates -> push button to check for updates? does this fetch updates still or give error?)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
a) if we create a name: DisableWindowsUpdateAccess value:1
Rita Hu -MSFT 9,661 Reputation points

2021-08-24T02:05:43.057+00:00

I'm sorry that I didn't make myself clear. Here are all my opinions for your reference:

First of all, there are must be a update resources which the clients could get updates from, no matter the internal WSUS server or MECM or Windows Update. It seems that you haven't deploy the Management Tool to deploy updates in the internal. Am I right? However, you also added the DisableWindowsUpdateAccess registry value to prevent the clients from scanning updates from Internet. There is no update resource which clients could scan updates for. Please try to deploy WSUS or MECE to destribute the updates in the internal environment.

In addition, we have to check for updates manually if the noAutoUpdate registry value setted as "1" . The clients will not scan for updates as schedule.

Hope the above will be helpful.

Regards,
Rita
pavan vemula 1 Reputation point

2021-08-24T02:34:13.2+00:00

thank you Rita

1) we have not disabled windows update access (DisableWindowsUpdateAccess ).
2) But our clients some have them have AU option - NoAutoUpdate =1

I want to make sure if we have set AU option - NoAutoUpdate =1 : Do client get updates or not? so in this case NO

so to be clear

1) Windows Update service should not be disabled (DisableWindowsUpdateAccess )no value set like this
2) AU option must set NoAutoUpdate =0 along with other options here under AU

so that clients would download and keep updates to install or schedule to install.

Because though we have not disabled windows service without AU option set to 0 - clients unable to fetch updates and giving errors when we try to check for updates.
Rita Hu -MSFT 9,661 Reputation points

2021-08-24T02:49:58.41+00:00

Thanks for your response.

I want to make sure if we have set AU option - NoAutoUpdate =1 : Do client get updates or not? so in this case NO
In my opinion, the clients could also get updates. The clients could check for updates manually and could not check for updates automatic as schedule. So it is not recommended. In fact, I have already tested it in my lab and it worked fine. Perhaps the other configuration lead to this error.

Answer 3

Limitless Technology 39,916

Hello,

this chains control the access in general to updates, independently of the source. The reason why you see errors, is because that chain does not accepted 1 or 0 as value.

For these registry values you have the next options.

NoAutoUpdate:
0 - Enable Automatic Updates (Default)
1 - Disable Automatic Updates
AUOptions:
2 - Notify for download and notify for install
3 - Auto download and notify for install
4 - Auto download and schedule the install

If you are looking into granular control of Windows Updates through registry (for instance through registry GPOs) I will recommend you the next article which covers this and more options.

Best regards,
Luis P

pavan vemula 1 Reputation point

2021-08-23T17:22:59.927+00:00

Thank you. AU options only to allow Auto updates? hope it does not disable windows update service

Logic I am thinking here is
if we enable AU option - autoupdate =0 then only it will look itself and pull updates otherwise manual
if we enable above key - other keys have to have like download and notify or install - should be enabled

if we are not using WSUS - and AU /Autoupdate =1 -> how this will do updates? windows update service still scan and fetch updates ?

Share via

Windows Update Service

3 answers

Your answer