Prevent users from installing Windows Updates

Question

This may belong on ServerFault, but Ill start here and if it gets moved, fine

Im trying to find a solution that prevents users from installing Windows/Automatic Updates on their workstations/laptops. There is a GPO that disables that functionality, however it disables it for everyone, including admins. Many end users are local admins, so even if I could enable it for admins, it wouldnt be an effective solution. Am I missing something, obvious, is their a GPO im missing?

Solution

You need to set this setting under User Configuration, then apply the GPO to the appropriate OU and security filter it so that it only targets the users you'd like to disable the policy for.

For instance, create a Disabled Windows Update user group. Assign all of the user accounts you'd like to disable Automatic Updates to this group. Then, when applying the GPO, security filter to this group.

The relevant GPO should be under: User Configuration\Administrative Templates\Start Menu and Taskbar the setting is Remove links and access to Windows Update

Comments

[STTR]

For this purpose it is possible to use firewall or create a logon script to add the changes to the registry.

[Ramhound]

@Keltari - You should be able to prevent it on the domain level. Even if they are an Administrator they would still prevented from running it. Although this is the point where you run your own server and push the update on the time schedule you want.