Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Instead of logging into each computer, I would like to find a way to disable Windows Update on each computer in the domain from a single location (e.g., the domain controller). The domain controller runs Windows Server Standard 2008. Computers in the domain run anything from Windows 7, to Vista, to XP. How can this be done?

share|improve this question
Oh please please don't do this. Manage your updates with WSUS or something, don't just turn it off. – MDMarra Jan 3 '13 at 23:43
up vote 4 down vote accepted

You can use Group Policy settings to disable both Windows Update and Automatic Updates.

To disable Windows Update and Automatic Updates on a per-computer basis, configure Turn off access to all Windows Update features in Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings

To disable access to Windows Update and Automatic Updates on a per-user basis, configure Remove links and access to Windows Update in User Configuration\Administrative Templates\Start Menu and Taskbar. Enabling this policy setting removes access to Windows Update features for the specified user, but Automatic Updates still checks for updates for the computer and does not notify users with this policy set.

share|improve this answer
Thanks Sergey. I had a bit of trouble finding the "Computer Configuration" node, but searched and found that I needed to be looking at the "Local Group Policy Editor" as opposed to "Group Policy Management". Also, I want to leave Windows Update functionality enabled, but I want to specifically disable the automatic update capability. It seems I can do this via the "Computer Configuration\Administrative Templates\Windows Components\Windows Update" node. Is that correct? Also, once I change a setting, how and when are the settings disseminated to domain computers? – Sipp Feb 3 '11 at 21:42
To apply GP settings for all PCs (incl. workstations and other servers) in your domain you need to edit 'Default domain policy' using "Group Policy Management" on your domain controller. And you'll find "Computer configuration" there. Please note: all local settings (you specified with "Local policy editor" on any workstation/member server) will be replaced with domain policy settings. – Sergey Feb 4 '11 at 9:12
Thank you, very helpful. – Sipp Feb 9 '11 at 3:03
@Sergey - I was not able to go down to the same folder tree paths in DDP using GPM as I was on LGPE. Trying to do this… – Alex S Sep 1 '15 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.