I wanted to prevent Windows Update from automatically restarting my PC while I was signed in. On this Windows 11 Pro machine, I used PowerShell to check and configure two Windows Update policy values.
This records the configuration we applied and verified in the registry. We have not yet tested it against an actual update-triggered restart.
Check the current settings
The following command can run in a regular PowerShell window:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue |
Select-Object AUOptions, NoAutoRebootWithLoggedOnUsers
Initially, it returned no output. In our case, the policy key did not exist. The -ErrorAction SilentlyContinue option suppresses the missing-key error; blank output alone is not proof that a restart policy is enabled.
Set the policy values
Open PowerShell or Windows Terminal as Administrator. Writing under HKEY_LOCAL_MACHINE requires an elevated session. Run:
$wuPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
New-Item -Path $wuPath -Force | Out-Null
New-ItemProperty -Path $wuPath -Name AUOptions -Value 4 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $wuPath -Name NoAutoRebootWithLoggedOnUsers -Value 1 -PropertyType DWord -Force | Out-Null
The commands create the policy key if necessary and write two DWORD values:
AUOptions = 4: automatic download and scheduled installation.NoAutoRebootWithLoggedOnUsers = 1: prevent automatic restart after scheduled update installation while a user is signed in.
These settings are a pair: Microsoft documents the signed-in-user restart restriction for automatic-update option 4. This also changes the update installation mode, so it is more than a standalone restart switch.
Verify the result
Run the first command again. Our output was:
AUOptions NoAutoRebootWithLoggedOnUsers
--------- ---------------------------
4 1
This confirms that the requested values were saved. It does not establish that Windows Update has already re-evaluated an existing pending restart.
Copy only the commands, without PS C:\...> or >> prompts. PowerShell does not use a trailing backslash for line continuation. The verification command continues after its pipe character.
Do I need gpupdate /force?
The commands write directly to the registry. gpupdate /force refreshes Group Policy; it is not a command to make Windows Update immediately reread arbitrary registry edits. We did not use it as an activation step.
There is no immediate activation procedure provided in the Microsoft reference below for this registry change. Plan a manual restart at a convenient time before relying on the configuration, and do not assume that writing these values cancels an already scheduled restart.
Limits to keep in mind
This is conditional restart control, not a universal reboot block. A restart explicitly scheduled through an update notification can still proceed. For Remote Desktop, only active RDP sessions count; a disconnected session does not provide the same protection. Microsoft also notes behavioral limitations for this policy. On managed devices, check for conflicting policies.
Continue installing updates and restarting manually when needed. Our verified result is the registry configuration shown above, not a guarantee that every restart path is blocked.
Reference: Microsoft Learn: Manage device restarts after updates.
