Manage automatic updates for Windows 10 or 11 devices

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; Cloud Identity Premium.  Compare your edition

As an administrator, you can specify how and when your organization’s Microsoft Windows 10 or 11 devices receive security updates and other important downloads through the Windows automatic updating service.

Configure automatic updates for Windows 10 or 11 devices

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click Windows Update settings.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Under Windows Update, select Enabled from the list of items.
6. Configure the options below.
   • Accept updates for Microsoft applications—When checked, devices will scan for app updates from Microsoft Update.
   • Automatic update behavior—Choose an option:
     • Notify before downloading—With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel.
     • Auto install and notify before restart—Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates immediately. If the installation requires a restart, the user is prompted to schedule the restart time. The user has up to 7 days to schedule the restart and after that, a restart of the device is forced. Enabling the user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart.
     • Auto install and restart—Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart.
     • Auto install and force restart—Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the user control panel to read-only.
   • Active hours—Manage a range of hours where update reboots are not scheduled. There is a 8 to 18 hour maximum range.
   • Accept updates from WSUS server instead of Microsoft Update—Specify whether the device should use Microsoft Update, Windows Server Update Services (WSUS), or the Microsoft Store.
   • Automatic update frequency—Specifies the hours that Windows will use to determine how long to wait before checking for available updates.
   • Receive quality updates—For quality updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours.
7. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Changes can take up to 24 hours but typically happen more quickly. Learn more

Disable automatic updates for Windows 10 or 11 devices

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click Windows Update settings.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Under Windows Update, select Disabled from the list of items.
6. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Use the “Not configured” setting for Windows Updates

Selecting Not configured under Windows Update removes any Windows Update settings on the device, reverting to the settings it had previously.

Related topics

• Add, edit, or delete custom settings for Windows 10 or 11 devices

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}