How to Disable Automatic Updates in Windows Desktops and Servers?
Introduction
Windows Automatic Updates help keep devices up to date by downloading and installing updates in the background. While this is useful for personal devices, many organizations prefer not to let endpoints update on their own because it can lead to unexpected reboots, unplanned downtime, and inconsistent patch levels across the fleet.
This becomes a bigger concern for production endpoints and remote devices. If each device updates independently, you lose the ability to control when updates install, which updates go first, and how rollouts are staged. In regulated or change-controlled environments, that lack of control can create operational risk and compliance gaps.
Disabling Windows Automatic Updates does not mean skipping security patching. It means shifting updates into a managed approval-and-deployment process, where you can test, approve, and roll out updates in stages, with clear visibility and reporting.
Deploy the following configuration patches from Supported Patches to disable or restore Windows Automatic Updates and the Check for Updates option on managed computers.
| Patch ID | Action |
|---|---|
| 105427 | Disable Windows Automatic Updates |
| 107895 | Disable the Check for Updates option |
| 107896 | Re-enable Windows Automatic Updates |
| 107900 | Re-enable the Check for Updates option |
If the patches are not listed, enable Optional Updates in Patch Database Settings and search again. A reboot is required for the change to take effect.
Steps to Disable
Two patches are available to control Windows update behavior across your managed endpoints.
- Deploy patch 105427 to disable Windows Automatic Updates.
- Deploy patch 107895 to disable the Check for updates (manual update) option.
Step 1: Disabling Windows Automatic Updates
Patch 105427 can be used to disable Windows Automatic Updates across all versions of Windows, from Windows XP up to the latest release, inclusive of Server OS editions.
When choosing the deployment target, select All domains to ensure the patch is also installed on machines that join the network in the future.
To confirm the settings have been successfully configured on the agent:
- Navigate to Windows Settings → Windows Update → Advanced Options → Configured Update Policies.
- Review the list of configured policies and confirm the Disable automatic updates policy appears under Policies set on your device.
- If the policy is present, the automatic updates setting has been successfully disabled.
Windows Update → Advanced Options → Configured Update Policies, showing the Disable automatic updates policy applied to the device.
Windows Automatic Updates has now been successfully disabled by deploying a patch, with no manual intervention required.
Step 2: Disabling the Check for Updates Option
Patch 107895 disables the Check for updates option, preventing users or local administrators from manually triggering updates outside your change window.
- Deploy patch 107895 to disable the Check for updates option.
- When choosing the deployment target, select All domains to ensure the patch is also installed on machines that join the network in the future.
- Verify that the option has been disabled in Settings as shown below.
Re-enable Windows Automatic Updates
To restore Windows Automatic Updates, deploy patch ID 107896 from Supported Patches to the target computers.
Re-enable Check for Updates
If patch ID 107895 disabled the Check for Updates option, deploy patch ID 107900 from Supported Patches to restore it. If you also want Windows Automatic Updates, deploy patch ID 107896 as well.
If the patches are not listed, enable Optional Updates in Patch Database Settings and search again. A reboot is required for the change to take effect.
Frequently Asked Questions
What does disabling Windows Automatic Updates mean?
Disabling Windows Automatic Updates means the device will no longer download and install updates automatically in the background. Updates can still be applied through a controlled enterprise patch process.
Why would an organization disable Windows Automatic Updates?
Many organizations disable automatic updates to avoid unexpected installs, unplanned reboots, and inconsistent patch timing. It helps enforce change control by moving updates into an approval-based rollout.
Is it safe to disable Windows Automatic Updates?
It can be safe if you still patch regularly using a managed workflow. The risk is not disabling auto-updates, but disabling auto-updates without a replacement patch schedule and compliance tracking.
Will disabling Automatic Updates stop security updates completely?
No. It prevents the endpoint from updating on its own, but security updates can still be deployed through your patch management process after testing and approval.
Does disabling Automatic Updates prevent unexpected reboots?
It reduces unexpected reboots caused by auto-install behavior. You can still decide when to reboot endpoints based on your maintenance window or reboot policy.
Should I also disable the Check for updates option?
Optional. Disabling Check for updates helps prevent users or local administrators from manually triggering updates outside your change window. Use it when you need stricter change control.
How do I verify Automatic Updates are disabled on an endpoint?
On the endpoint, navigate to Settings → Windows Update → Advanced Options → Configured Update Policies and confirm that the applied policy indicates automatic updates are disabled or controlled as intended.
Why does Windows Update say Some settings are managed by your organization?
This message appears when update policies are enforced by management tools or Group Policy. It indicates users cannot freely change update settings because the device is following centrally managed configuration.
Can Group Policy (GPO) override this configuration?
Yes. Domain GPOs can override local settings. If settings revert or fail to apply, review the effective GPOs applied to the device and resolve any conflicts.
How do I roll back and re-enable Automatic Updates later?
Deploy patch 107896 to re-enable Automatic Updates, or patch 107900 to re-enable the Check for updates option. After re-enabling, verify the endpoint update policy status again under Configured Update Policies.