Windows Update policies allow administrators to automate operating system maintenance across managed fleets without disrupting learning or work hours. By configuring these settings at the profile level, you can govern update deferrals, enforce active hours to prevent unexpected reboots, and define compliance deadlines across all assigned devices.
Accessing the Windows Update Policy
Follow these steps to navigate to the policy configuration settings:
- In the Mobile Guardian Dashboard, navigate to Profiles.
- Select the desired profile you wish to configure.
- Open the What tab.
- Scroll down to locate and expand the Windows Update Policy section.
Rules for how Windows devices in this profile install updates. They are saved as Windows Update policies (Policy/Config/Update) and reach every enrolled Windows device in the profile on its next sync. Clearing a setting disables its policy. Individual patches are handled under Devices › Patch Management.
There are 3 Presets available:
- School day
- Pilot ring
- Exam freeze
Each has its own populated set of rules. You are able to edit them to your own preference. Or set your own rules.
1. Deferral & Servicing
Controls how long updates are delayed to allow for phased rollouts (pilot rings) and sets update branches:
- Quality Update Deferral: Delays monthly cumulative and security patches by 0–30 days.
- Feature Update Deferral: Delays major annual OS upgrades (e.g., 25H2) by 0–365 days.
- Target Release Version: Locks devices to a specific version (e.g., Windows 11 25H2 or 24H2) until explicitly changed.
- Servicing Channel & Insider Builds: Dictates the update channel and controls whether users can opt into Windows Insider Preview builds (Block, Allow, or Leave to User).
2. Active Hours & Scheduling
Prevents disruption by controlling when updates install and force restarts:
- Active Hours: Specifies a daily window (between 0 and 18 hours long, default 8 AM–5 PM) where automatic update restarts are blocked.
- Automatic Update Behaviour: Configures how updates download and apply (e.g., auto-install during maintenance, auto-install at a scheduled time, or turn off entirely).
- Scheduled Install Time/Day: Sets a recurring day and hour for updates if scheduled installation is selected.
3. Deadlines & Grace Periods
Enforces update installation after deferrals expire:
- Quality/Feature Update Deadlines: Specifies the maximum number of days (0–30) a user can delay an update once its deferral period ends before an installation is forced.
- Grace Period: Gives users advance warning (0–7 days) before an automatic restart occurs.
- No Automatic Restart Before Deadline: Forces Windows to wait until the exact deadline before enforcing a reboot.
4. Pause
- Temporarily stops all new Quality or Feature updates for up to 35 days starting from a specified date.
5. Sources, User Control & Other Settings
- WSUS Server: Points devices to an internal update server instead of Microsoft's public servers.
- User Control & Notifications: Options to prevent users from manually pausing updates and to suppress update notifications (e.g., hide all notifications except required restart warnings).
- Driver & Microsoft Product Updates: Choose whether hardware drivers are excluded from Windows Update (managed via OEM instead) or if updates for other Microsoft products (like Office) are included.
We hope you found this helpful.
Thanks for reading! 🙂