We have automated the deployment of Windows updates on our servers through the use of local GPO. Everything works great and a screenshot of the existing configuration can be found in the screenshot attached below.

Local GPO Windows Updates

We have noticed though, that Optional Updates are being ignored, not installed automatically and need manual intervention. Is there any way, either Microsoft official or a registry hack to force the installation of the Optional Updates as well?

Thank you in advance.


You comment that you do not use WSUS due to them not being on the domain. You can configure clients directly via the registry to use a specified WSUS server and set them to automatically install updates if desired. GPOs ease the automation, but are not requirements. Scheduled tasks are one of many ways to set a specified time to install if you're up to the scripting.

The relevant registry keys:


From TechNet: "Configure Automatic Updates in a Non–Active Directory Environment" on these keys and what goes under them: https://technet.microsoft.com/en-us/library/cc708449(v=ws.10).aspx

  • Updated answer with TechNet article link and registry keys directly. Good luck! – Matthew Wetmore Dec 16 '16 at 17:59

It looks like you're not using a WSUS server. Usually, optional updates are approved via WSUS and pushed via GPO scheduling. You have selected Recommended Updates so that won't be a problem.

Microsoft says optional updates can only be installed manually.

  • Thanks for your reply, you are right, we are not using a WSUS server in this scenario as these machines are not part of a domain, so I am assuming there is no other way to be done. – croussou Dec 14 '16 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.