Instead of logging into each computer, I would like to find a way to disable Windows Update on each computer in the domain from a single location (e.g., the domain controller). The domain controller runs Windows Server Standard 2008. Computers in the domain run anything from Windows 7, to Vista, to XP. How can this be done?

  • 2
    Oh please please don't do this. Manage your updates with WSUS or something, don't just turn it off.
    – MDMarra
    Jan 3 '13 at 23:43

You can use Group Policy settings to disable both Windows Update and Automatic Updates.

To disable Windows Update and Automatic Updates on a per-computer basis, configure Turn off access to all Windows Update features in Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings

To disable access to Windows Update and Automatic Updates on a per-user basis, configure Remove links and access to Windows Update in User Configuration\Administrative Templates\Start Menu and Taskbar. Enabling this policy setting removes access to Windows Update features for the specified user, but Automatic Updates still checks for updates for the computer and does not notify users with this policy set.

  • Thanks Sergey. I had a bit of trouble finding the "Computer Configuration" node, but searched and found that I needed to be looking at the "Local Group Policy Editor" as opposed to "Group Policy Management". Also, I want to leave Windows Update functionality enabled, but I want to specifically disable the automatic update capability. It seems I can do this via the "Computer Configuration\Administrative Templates\Windows Components\Windows Update" node. Is that correct? Also, once I change a setting, how and when are the settings disseminated to domain computers?
    – Sipp
    Feb 3 '11 at 21:42
  • To apply GP settings for all PCs (incl. workstations and other servers) in your domain you need to edit 'Default domain policy' using "Group Policy Management" on your domain controller. And you'll find "Computer configuration" there. Please note: all local settings (you specified with "Local policy editor" on any workstation/member server) will be replaced with domain policy settings.
    – Sergey
    Feb 4 '11 at 9:12
  • @Sergey - I was not able to go down to the same folder tree paths in DDP using GPM as I was on LGPE. Trying to do this serverfault.com/questions/718232/…
    – Alex S
    Sep 1 '15 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.