Does Azure override Windows update reboot settings?

Question

We have auto updates and restarts disabled for Windows updates on one of our VMs (it's a Filemaker Server, and we are working on a script to shut down Filemaker gracefully before our scheduled restarts), but it has rebooted unexpectedly on it's own, particularly when simply checking for updates (clicking "Check for Updates" in Windows Update automatically starts the download and eventually reboots the server). In "... Settings\Windows Update\Windows Update", I've disabled the option to automatically update so now it should just tell you that they are available. BUT... When I clicked Check for Updates, they started to install and then I got a message that “Your device will restart to update outside of active hours."

Is Azure controlling this and overriding the Windows Update settings? There is also a note that “Some settings are managed by your organization” in Windows Update and Advanced options, which I assume is referring to Azure?

Below are notes regarding how we have revised the auto update settings for Windows:
Logged into the FMP server. in gpedit.msc, changed the setting for Computer Configuration\Administrative Templates\Windows Components\Windows Updates\Configure Automatic Updates and set the value to 4 (notify for download and auto install) so that Windows will not install updates automatically.
Created a new new registry key at HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU called NoAutoRebootWithLoggedOnUsers and set the value to 1. Set AUOptions in the same key to 2 (Notify before downloading)

Any suggestions are welcome.
Thanks,
nikki

Answer 1

Hello MCJUDD-9848

The reason for this is that the manual call to Check for Updates overrides the Auto Update Disabled.

In this case you would like to complete block the manual updates for users:

In: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate

Create New > DWORD Value. Name the newly created registry DWORD (REG_DWORD) as SetDisableUXWUAccess. This registry DWORD can be used to allow/prevent users to check for updates in Windows 10. Double click on this registry DWORD to modify its Value data:

Finally, set the Value data to 1 and click OK to prevent users from checking updates (or 0 to allow them). Close Registry Editor and reboot to make changes effective.

You can also try to use the Group Policy "Remove access to use all Windows update features." The full path to this Group Policy is:
Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

@Niek Pruntel and @MC JUDD ,

Azure Update Management v1 doesn't override any VM update settings in the operating system level. Update Management is just a triggering tool here. It uses Microsoft Monitoring Agent to trigger updates, simply.

https://learn.microsoft.com/en-us/azure/automation/update-management/configure-wuagent