> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure the Windows Update Library Item > Configure the Windows Update Library Item in Iru Endpoint. Manage update rings, deferral periods, active hours, and the end-user update experience. This Library Item is available for Windows devices The **Windows Update** Library Item lets you manage Windows Update settings and the end-user update experience on Windows devices. Control how and when updates are offered, set active hours to avoid disruptive restarts, and limit what users can do from the Windows Update UI. For detailed technical background on each setting, refer to Microsoft's official [Update Policy CSP documentation](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update). ## Create a Windows Update Library Item To add this Library Item to your Iru Endpoint Library, follow the steps in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article. Navigate to the **Library** and select **Add Library Item**. Search for and select **Windows Update**. Give the Library Item a **Name**. Assign the profile to one or more **Blueprints**. You can use Assignment Maps within Blueprints for conditional logic if needed. ## Settings The following settings are available for Windows Update. ### Manage Updates Offered from Windows Update #### Allow Optional Content Controls whether devices receive optional updates and gradual rollouts (controlled feature rollouts, or CFRs) in addition to required updates. Options: * Don't receive optional updates * Automatically receive optional updates (including CFRs) * Automatically receive optional updates only * Users can select optional updates ### Manage End-User Experience #### Allow Auto Update Controls how updates are installed: notify only, auto install, or auto install and restart. Options: * Notify the user before downloading the update * Auto install and then notify the user to schedule a restart * Auto install and restart (default) * Auto install and restart at a scheduled time * Allow the local administrator to choose the setting * Turn off automatic updates #### Active Hours Start Start of the active hours window (hour 0–23). Windows avoids restarting the device for updates during this time. #### Active Hours End End of the active hours window (hour 0–23). Restarts can occur after this hour. #### Set Disable Pause UX Access Controls whether users can pause updates from the Windows Update UI. Options: **Users can pause updates**, or **Remove the pause option from the device UI**. Choose the latter to prevent users from stalling updates. #### Manage Preview Builds Controls whether the device can receive Windows Insider Preview builds. Options: * Disable Preview builds * Disable Preview builds once the next release is public * Enable Preview builds * Preview builds are left to user selection #### Update Notification Level Controls which update notifications users see: default, hide all except restart warnings, or hide all including restart warnings. Options: * Use the default Windows Update notifications * Disable restart notifications for updates (excludes restart warnings) * Disable all notifications for updates (includes restart warnings) ## Advanced Settings These settings appear in an expandable section of the Library Item. They are not configured by default and are for admins who need more control over update behavior. * **Allow non-Microsoft signed update** Lets the device accept updates signed by someone other than Microsoft when using an intranet update service (for example, WSUS for third-party patches). * **Automatic maintenance wake up** Allows Automatic Maintenance to wake the device for its daily scheduled maintenance if needed. * **Disable WUfB safeguards** Windows Update for Business (WUfB). When enabled, devices skip Microsoft safeguard holds that block upgrades when known compatibility issues exist. Use only for validation; it can lead to poor upgrade experiences. * **Exclude WU drivers in quality update** Excludes driver updates from Windows quality updates. Use if you manage drivers separately. * **Active hours max range** Maximum number of hours (8–18) that users can set for their active hours window, starting from the active hours start time. * **Allow auto Windows Update download over metered network** Allows Windows Update to download updates over metered (for example, cellular) connections. May incur data charges. * **Allow MU update service** Controls whether the device scans for app and other Microsoft product updates via Microsoft Update. * **Allow temporary enterprise feature control** When allowed, features delivered in monthly quality updates (servicing) are turned on before the next feature update. When disabled, those features stay off until the feature update that includes them. * **Configure feature update uninstall period** Number of days (2–60) that users can uninstall a feature update after it is installed. * **No update notifications during active hours** Reduces or turns off Windows Update notifications during active hours (optionally excluding restart warnings). Notifications can still appear after the deadline if configured. * **Scheduled install day** Day of the week (or every day) when updates are installed. Only applies when **Allow auto update** is set to **Auto install and restart at a scheduled time** or **Allow the local administrator to choose the setting**. Options: Every day, Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday. * **Scheduled install every week** When enabled, updates are scheduled every week. Only applies when **Allow auto update** is set to **Auto install and restart at a scheduled time** or **Allow the local administrator to choose the setting**. * **Scheduled install first week** Schedule install during the first week of the month (days 1–7). Use with **Scheduled install day** for a specific weekday (for example, first Tuesday). * **Scheduled install second week** Schedule install during the second week of the month (days 8–14). Use with **Scheduled install day** for a specific weekday. * **Scheduled install third week** Schedule install during the third week of the month (days 15–21). Use with **Scheduled install day** for a specific weekday. * **Scheduled install fourth week** Schedule install during the fourth week of the month (days 22–31). Use with **Scheduled install day** for a specific weekday. * **Scheduled install time** Hour of the day (0–23) when scheduled updates install. There is about a 30-minute window. Only applies when **Allow auto update** is set to **Auto install and restart at a scheduled time** or **Allow the local administrator to choose the setting**. * **Set disable UX WU access** When enabled, users cannot scan, download, or install updates from the Windows Update settings UI. * **Set EDU restart** Allows the device to automatically restart outside active hours to finish updates. Intended for Education (EDU) scenarios. * **Allow update service** When using an intranet update service, this controls whether the device can still use Microsoft Update, WSUS, or Microsoft Store. Disabling can break Store and other public services. * **Detection frequency** How many hours Windows waits before checking for updates, plus a 0–4 hour random offset. Only applies when using a WSUS server. Range: 1–22 hours. * **Do not enforce enterprise TLS cert pinning for update detection** When enabled, the Windows Update client does not enforce TLS certificate pinning for update detection. Microsoft recommends keeping TLS pinning enabled for WSUS environments. * **Fill empty content URLs** Lets Windows Update Agent determine download URLs when metadata does not include them. Use when working with an alternate download server or ISV cache that does not populate all content URLs. * **Set policy driven update source for driver updates** Chooses whether driver updates come from Windows Update or your WSUS server. Requires **Update service URL** to be set. * **Set policy driven update source for feature updates** Chooses whether feature updates come from Windows Update or your WSUS server. Requires **Update service URL** to be set. * **Set policy driven update source for other updates** Chooses whether other updates come from Windows Update or your WSUS server. Requires **Update service URL** to be set. * **Set policy driven update source for quality updates** Chooses whether quality updates come from Windows Update or your WSUS server. Requires **Update service URL** to be set. * **Set proxy behavior for update detection** Allows using the user proxy as a fallback when detecting updates with an HTTP WSUS server. Using the user proxy can reduce security; prefer system proxy when possible. * **Update service URL** URL of your WSUS server so devices check for updates there instead of Microsoft Update (for example, `https://server:8531` or `http://server:8530`). Per-type update source settings require this field to be configured before they take effect. * **Update service URL alternate** Alternate intranet server for update detection, download, or statistics reporting. Use this to specify a secondary download server or redirect reporting traffic separately from the main WSUS server. ## Considerations When settings are left as "Not configured," they do not override the local device configuration. This is how Not configured interacts with existing device config. When you disable access to the Windows Update UI (**Set disable UX WU access**), users cannot manually check for updates. Ensure your update policies apply to all relevant devices before you enable this. Set active hours to match your organization's work schedule so restarts do not disrupt users during the day. For per-type source settings (feature, quality, driver, other), **Update service URL** must be configured before they take effect. Disabling **Allow update service** can break Microsoft Store and other public Microsoft services. Verify those services remain accessible before disabling. **Detection frequency** only applies when a WSUS server is in use; it has no effect in cloud-only Windows Update configurations. When using **Set proxy behavior for update detection**, enabling the user proxy fallback reduces security. Prefer system proxy unless your environment requires otherwise. For update detection, enabling **Do not enforce enterprise TLS cert pinning for update detection** turns off TLS pinning and reduces the security of update scanning. Disabling pinning has security impact. Enable only if required by your WSUS infrastructure. ## Best Practices The main settings have Iru-recommended defaults. Start with those, then adjust for your organization. Set **Active hours start** and **Active hours end** to match your users' workday so restarts do not occur during work hours. Set **Set disable pause UX access** to **Remove the pause option from the device UI** so users cannot stall updates from the Windows Update UI. Test your configuration on a small group of devices before rolling out to the full fleet. A pilot group helps you catch unexpected restart behavior. ## Troubleshooting When updates are not installing on schedule, check the schedule, active hours, and **Allow auto update**. **Possible causes:** * Allow auto update is not set to the intended option * Scheduled install time or day misconfigured * Active hours configured too broadly (for example, close to the maximum allowed range) **Solutions:** * Verify that Allow auto update is set to your intended option * Check that the scheduled install time and day are configured correctly * Ensure active hours are configured to a realistic workday window and respect the **Active hours max range** setting **Possible causes:** * **Set disable pause UX access** is not enabled or is set to allow pausing **Solutions:** * Set **Set disable pause UX access** to **Remove the pause option from the device UI** Restarts during business hours often relate to active hours and time zone. **Possible causes:** * Active hours start and end do not cover the full workday * Incorrect time zone or configuration **Solutions:** * Review your **Active hours start** and **Active hours end** settings * Make sure the range covers the full workday for your users **Possible causes:** * **Manage preview builds** is set to allow preview builds or left to user selection **Solutions:** * Set **Manage preview builds** to **Disable Preview builds** to prevent devices from receiving Windows Insider builds When devices do not receive updates from the WSUS server, verify the following. Common causes include **Update service URL** and reachability. **Possible causes:** * **Update service URL** not configured or not reachable from devices **Solutions:** * Verify that **Update service URL** is configured and reachable from your devices. Per-type source settings will not take effect without a valid Update service URL. When Microsoft Store or other public Microsoft services are broken or inaccessible, check the following. **Possible causes:** * **Allow update service** is disabled **Solutions:** * Check whether **Allow update service** is disabled. Disabling it can block access to Microsoft Store and other public Microsoft services. When updates are not detected on the expected schedule, review the following. This often involves **Detection frequency** and the random offset. **Possible causes:** * **Detection frequency** misconfigured or not accounting for random offset **Solutions:** * Review **Detection frequency**. Windows adds a 0–4 hour random offset to the configured interval. If detection frequency is not configured, the CSP default is 22 hours. When update scanning fails with TLS errors (for example, with WSUS), check the following. Common causes include WSUS certificate and TLS pinning. **Possible causes:** * WSUS server certificate conflicts with TLS pinning **Solutions:** * If your WSUS server uses a certificate that conflicts with TLS pinning, enable **Do not enforce enterprise TLS cert pinning for update detection** after confirming the certificate configuration on the WSUS server. When download URLs are missing or broken (for example, with an alternate download server or ISV cache), try the following. **Possible causes:** * Alternate download server or ISV cache not populating content URLs in metadata **Solutions:** * If you use an alternate download server or ISV cache, enable **Fill empty content URLs** so Windows Update Agent can resolve download paths when they are absent from update metadata. ## Related Articles Curate, create, and manage Library Items and add them to Blueprints Configure Microsoft Defender antivirus and threat protection on Windows Configure and enforce firewall settings for Windows devices Configure BitLocker encryption on Windows devices Set up Windows device enrollment Configure managed OS updates for Mac computers