{"id":3168,"date":"2026-02-20T12:08:57","date_gmt":"2026-02-20T12:08:57","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/windows-update-policy\/"},"modified":"2026-02-20T12:36:59","modified_gmt":"2026-02-20T12:36:59","slug":"windows-update-policy","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/patch-management\/windows-update-policy\/","title":{"rendered":"Windows Update Policy \u2013 Policy Creation & Association"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

The Windows Update Policy<\/strong> in Zecurit lets you define exactly how managed Windows devices download, install, and restart after updates. Instead of relying on default Windows settings \u2014 which vary per device \u2014 you create a centralized policy inside a Profile<\/strong> and push it to any device group in your organization.<\/p>\n\n\n\n

This page walks you through creating a new profile, configuring the Windows Update Policy within it, and associating it with your devices.<\/p>\n\n\n\n

Prerequisites<\/h2>\n\n\n\n
    \n
  • You must have a Zecurit account with administrator access.<\/li>\n\n\n\n
  • At least one device group should exist under Groups and Devices<\/strong> before association.<\/li>\n\n\n\n
  • Devices must be enrolled in Zecurit to receive the policy.<\/li>\n<\/ul>\n\n\n\n

    Step 1 : Create a New Profile<\/h2>\n\n\n\n
      \n
    1. In the left sidebar, go to Configurations \u2192 Create Profile<\/strong>.<\/li>\n\n\n\n
    2. Enter a Profile Name<\/strong> : for example, Windows Patch<\/code>.<\/li>\n\n\n\n
    3. Enter a Description<\/strong> : for example, Patch for IT Dept<\/code>.<\/li>\n\n\n\n
    4. Click Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n
      \n

      Tip:<\/strong> Use descriptive profile names that reflect the target audience or policy intent (e.g., IT-Patch-Strict<\/code> vs. HR-Patch-Deferred<\/code>). This makes it easier to manage multiple profiles as your organization grows.<\/p>\n<\/blockquote>\n\n\n\n

      Step 2 : Open Windows Update Policy<\/h2>\n\n\n\n

      After clicking Continue<\/strong>, you will land on the profile configuration screen. In the left panel under the profile name, you will see several policy categories:<\/p>\n\n\n\n

        \n
      • BitLocker<\/li>\n\n\n\n
      • Device Access Control<\/li>\n\n\n\n
      • Application Control<\/li>\n\n\n\n
      • Power Management<\/li>\n\n\n\n
      • Firewall<\/li>\n\n\n\n
      • User Management<\/li>\n\n\n\n
      • Windows Update Policy<\/strong> \u2190 Select this<\/li>\n<\/ul>\n\n\n\n

        Click Windows Update Policy<\/strong> to begin configuring update behavior.<\/p>\n\n\n\n

        Step 3 : Configure Automatic Updates<\/h2>\n\n\n\n

        Under Automatic Updates Configurations<\/strong>, choose one of the following modes:<\/p>\n\n\n\n

        Option<\/th>Behavior<\/th>Recommended For<\/th><\/tr><\/thead>
        Notify for download and install<\/strong><\/td>Users are notified before anything is downloaded<\/td>Environments where users manage their own workflow<\/td><\/tr>
        Auto download and notify for install<\/strong><\/td>Downloads happen silently; users choose when to install<\/td>Most organizations<\/td><\/tr>
        Auto download and schedule install<\/strong><\/td>Fully automated download and installation<\/td>IT-managed devices with no user interaction needed<\/td><\/tr>
        Disable automatic updates<\/strong><\/td>No automatic updates \u2014 manual only<\/td>Highly controlled or air-gapped environments<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n

        Best Practice:<\/strong> For most organizations, Auto download and schedule install<\/strong> is recommended as it ensures consistent patching without relying on end-user action.<\/p>\n<\/blockquote>\n\n\n\n

        Step 4 : Set Update Deferrals<\/h2>\n\n\n\n

        Under Update Deferrals<\/strong>, you can delay updates to allow time for testing before broad rollout.<\/p>\n\n\n\n

        Defer Quality Updates (Security)<\/strong><\/p>\n\n\n\n

          \n
        • Set the number of days to delay monthly security and critical updates (max 30 days).<\/li>\n\n\n\n
        • Example: 7 days<\/code> gives your IT team time to test patches on pilot machines before rolling out to the full fleet.<\/li>\n<\/ul>\n\n\n\n

          Defer Feature Updates<\/strong><\/p>\n\n\n\n

            \n
          • Delay major Windows version upgrades (max 365 days).<\/li>\n\n\n\n
          • Example: 30 days<\/code> is a common setting to avoid being on a new Windows feature release on day one.<\/li>\n<\/ul>\n\n\n\n

            Defer Quality Updates (Security) \u2014 Version Pin<\/strong><\/p>\n\n\n\n

              \n
            • Enter a specific Windows build (e.g., 24H2.24H3<\/code>) to pin devices to a known-good version.<\/li>\n<\/ul>\n\n\n\n

              Product Version<\/strong><\/p>\n\n\n\n

                \n
              • Select the Windows version to target (e.g., Windows 11<\/code>) from the dropdown.<\/li>\n<\/ul>\n\n\n\n

                Step 5 : Configure User Experience Settings<\/h2>\n\n\n\n
                Setting<\/th>Description<\/th>Recommended<\/th><\/tr><\/thead>
                Allow users to pause updates<\/td>Lets users temporarily delay updates from Settings<\/td>Off for strict environments<\/td><\/tr>
                Remove access to Windows Update<\/td>Hides Windows Update in Settings for end users<\/td>On for IT-managed fleets<\/td><\/tr>
                Allow non-administrators to receive update notifications<\/td>Notifies all users (not just admins) about pending updates<\/td>On<\/td><\/tr>
                Update Notification Level<\/td>Controls the verbosity of update notifications (Default, Disabled, Basic, etc.)<\/td>Default<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

                Step 6 \u2013 Set Active Hours & Restart Behavior<\/h2>\n\n\n\n

                Preventing forced restarts during work hours is critical for user productivity.<\/p>\n\n\n\n

                Configure Active Hours<\/strong><\/p>\n\n\n\n

                  \n
                • Toggle On<\/strong> to prevent automatic restarts during business hours.<\/li>\n\n\n\n
                • Set Active Hours Start<\/strong> and Active Hours End<\/strong> (maximum range: 18 hours).<\/li>\n\n\n\n
                • Example: 08:00 AM<\/code> to 06:00 PM<\/code><\/li>\n<\/ul>\n\n\n\n

                  Restart Deadlines<\/strong><\/p>\n\n\n\n