How to Control Automatic Updates and Restarts in Windows 11 with Group Policy

Note: The screenshots in this article were captured in a Japanese-language Windows environment. Menu and setting names may differ slightly in an English-language installation.

For permanent kiosks, digital signage, and unmanned information terminals, reboots and notifications caused by Windows Update may interrupt display during business hours. In this article, we will use the Windows 11 Local Group Policy Editor (gpedit.msc) to control automatic updates, restarts during business hours, update notifications, and user Windows Update operations.

Verification/target items	Content
Target OS	Windows 11
Target edition	Pro／Enterprise／Education
configuration tool	Local Group Policy Editor (gpedit.msc）
Main purpose	Automatic updates, restarts, notifications, and user interaction controls
Recommended operation	Regular updates during maintenance hours outside business hours

How to control Windows Update on kiosk terminals

Rather than permanently stopping updates, the kiosk terminal is designed to have the following roles:

Control target	purpose
automatic update	Avoid downloading and installation at times not intended by the administrator
automatic restart	Prevent display interruptions during business hours/exhibition hours
Update notification	Do not display update instructions or restart warnings on the user's screen
Windows Update UI	Prevent kiosk users from performing update operations
maintenance work	Perform updates and restarts at the date and time determined by the administrator.

Microsoft recommends allowing automatic updates on most devices. On the other hand, update notification option 2 (hide all notifications including restart warnings) is listed in the official documentation as an option for kiosks with automatic restart disabled.

Points to note before starting work

• gpedit.msc is not included as standard in Windows Home.
• Administrator privileges are required to change settings
• If your organization has domain group policies or MDM, it may conflict with local settings
• Item names and arrangement may differ depending on the Windows version and administrative template.
• Check on a test machine before deploying to a production device
• Stop automatic updates after deciding the update date (monthly, etc.), the person in charge, and the recovery method in case of update failure.

We do not recommend adding the Local Group Policy Editor in Windows Home using unofficial methods. Also, even if you directly set the registry value, the same behavior may not occur depending on the edition or policy support conditions.

Start gpedit.msc

1. Open "Run" using Win + R.
2. Enter gpedit.msc and click OK.

1. Verify that the Local Group Policy Editor opens.

If you can't find gpedit.msc, check your Windows edition.

Disable optional updates

Open the following location:

Computer Configuration
  → Administrative Templates
  → Windows Components
  → Windows Update
  → Manage updates offered from Windows Update

The category structure under Windows Update may differ depending on the Windows version.

Double-click "Turn on optional updates."

Disable the policy and click OK.

This setting is to disallow automatic receipt of optional non-security updates and gradual feature rollouts. This setting does not stop all quality updates and feature updates.

Also, even if you disable "When to receive preview builds and feature updates" and "When to receive quality updates" in the image, those updates themselves will not be disabled. Do not set this for the purpose of stopping updates, as this will result in no update postponement conditions being specified.

Stop automatic restart during business hours

Open the following location:

Computer Configuration
  → Administrative Templates
  → Windows Components
  → Windows Update
  → Manage end-user experience

Open "Turn off automatic restart for updates during active hours" and set as follows:

• Condition: Enabled
• Active hours: Specified according to actual business hours/exhibition hours

This policy prevents automatic restarts during the specified active hours. It is not a setting that will permanently stop it until it is restarted outside of active hours. Allow maintenance time to update and restart the kiosk after it is finished.

Disable automatic updates

Open "Configure automatic updates" under "Manage end-user experience," and set it to Disabled.

This setting disables automatic updates, but administrators can manually download and install updates from the Windows Update settings screen. This does not mean that "Windows Update does not work at all" or "Windows updates cannot be detected."

If manual maintenance is difficult, it may be safer to set this policy to Enabled instead and manage download notifications and installation timing that way, rather than disabling automatic updates outright. Choose according to the number of terminals and your maintenance system.

Hide update notifications

Open "Update Notification Display Options" in the same category and set as follows:

• Condition: Enabled
• Display options: 2 - Turn off all notifications, including restart warnings

Option 2 doesn't show until reboot warning. Prepare and configure automatic restart controls and administrator maintenance plans first.

Restricting Windows Update operations by users

If you do not want users to perform operations such as "Check for updates," select "Remove access to all Windows Update features" under Windows Update and set it to Enabled. Depending on your version of Windows, the item name may appear as "Turn off access to all Windows Update features."

This policy is a setting that restricts the Windows Update UI for users. Microsoft official documentation explains that background scanning, downloading, and installation will continue according to separately configured policies. Therefore, this alone does not mean that automatic updates have been stopped.

We have also observed the following legacy policies in our published environments:

Computer Configuration
  → Administrative Templates
  → system
  → Internet Communication Management
  → Internet Communication settings
  → Turn off access to all Windows Update features

This legacy policy broadly affects the Windows Update website, related links, automatic updates, and driver acquisition via Windows Update. Normally, you should first use the current policy under Windows Update and check the necessity and scope of impact before considering it.

Reflect and confirm the policy

Once configured, run the following in a command prompt or PowerShell opened as an administrator:

gpupdate /force

Then restart Windows and check the following:

1. In gpedit.msc, confirm that each policy is in its intended state.
2. Automatic restart due to update does not occur during business hours
3. Kiosk users don't see update notifications
4. Kiosk users cannot operate Windows Update
5. Can be manually updated during maintenance scheduled by the administrator
6. Display apps and autostart are restored to normal after updating

As an administrator, you can check the results of policy application by running gpresult /r /scope computer. Please also check the domain policy and MDM settings on the organization management terminal.

How to restore settings

Return each policy you changed this time to Not configured, run gpupdate /force, and restart Windows. Not configured does not necessarily mean that all settings will return to their initial state. If domain policies, MDM, registry, and other Windows Update protections remain in place, those settings will continue to apply.

Summary of settings

purpose	policy	Setting value
Do not allow automatic receipt of optional updates	Enable optional updates	invalid
Prevent restarts during business hours	Turn off automatic restart for updates during active hours	Valid + time specified
Stop automatic updates and perform manual maintenance	Configure automatic updates	invalid
Hide update notifications including restart warnings	Update notification display options	Valid + Option 2
Restrict user update operations	Remove access to all Windows Update features	Valid

Reference materials

• Configure Windows Update clients with Group Policy (Microsoft Learn)
• Manage additional Windows Update settings (Microsoft Learn)
• Windows Update policy according to device type (Microsoft Learn)
• Manage device restarts after updates (Microsoft Learn)

Summary

For kiosks and digital signage, it is safer to prevent automatic restarts and notifications during business hours and have the administrator update during maintenance hours than to completely stop Windows Update. In particular, remember that setting "Configure automatic updates" to Disabled still allows manual updates, and don't forget to set "Update notification display options" to Enabled with option 2 selected.

After setting, do not make judgments based only on the policy display; instead, check the actual device for notifications, restarts, and update operations by kiosk users, as well as manual updates by administrators.