How to Stop Automatic Windows Updates (Windows 11 & 10)

Welcome back to our Windows Made Simple series, which we run for our non-tech readers who want to actually understand their computer instead of copying commands they don't recognise.

In our last post we looked at what to do when your PC runs out of disk space. Today, Jake has a different kind of problem — and it cost him a sale.

Let's join him at the counter.

---

Jake's Problem: The Billing PC That Restarted Mid-Sale

Jake runs a small mobile phone shop. Two staff, a billing counter, and one ageing Windows PC that handles every invoice that goes out of the door.

Last Saturday — his busiest day — a customer was paying for an iPhone. Jake had the invoice half-filled. Then the screen went blue and cheerfully announced: "Working on updates, 30% complete. Don't turn off your computer."

Twenty-five minutes. A queue of six people. One customer walked out.

"Ethan," he said that evening, "I need this to never happen again. Can I just switch updates off completely?"

Ethan pulled up a chair. "You can. But before I show you how, let me show you why you probably shouldn't — and then give you six ways to do it, so you can pick the one that fits your shop. Deal?"

"Deal."

First, What Is Windows Update Actually Doing?

"Before we switch anything off," Ethan said, "do you know what it's installing?"

Jake shrugged. "Stuff. It just says 'updates'."

"Right. And that's the problem — it's actually three very different things wearing the same label."

1. Security updates

Small patches that close holes attackers use. These come out on the second Tuesday of every month — the industry calls it Patch Tuesday. They usually install in under two minutes and rarely need a restart.

"These are the ones you don't want to block," Ethan said. "Your billing PC has customer phone numbers and payment records on it. A missing security patch is how those leak."

2. Quality updates

Bug fixes and small improvements. Sometimes useful, occasionally the cause of a new problem. Delaying these by a week or two is completely reasonable — it lets other people find the bugs first.

3. Feature updates

The big ones. A new version of Windows, essentially. These take 20–40 minutes, need several restarts, and are what actually interrupted Jake's sale. They arrive once or twice a year.

Before You Change Anything: Back Up

"One rule," Ethan said. "Before you touch Group Policy or the Registry — and especially before you delay a feature update for months — make sure your invoices exist somewhere other than that one PC."

Jake looked blank. "They're in a folder on the desktop."

"On the machine that just blue-screened. Jake."

For a shop PC holding billing records, one copy is not a backup. Any of these work:

• A cloud backup service — runs automatically, survives theft, fire, and a dead hard drive. For a business PC this is the sensible option.
• An external drive plus Windows' built-in File History. Cheap, but only helps if you remember to plug it in.
• Both — what most shops with real records end up doing.

If a drive has already failed on you and you're reading this after the fact, that's a data recovery job, not a backup one — and it's far more expensive than the backup would have been.

What Is Group Policy Editor? (The Full Explanation)

Every guide on the internet says "open Group Policy Editor" as if you already know what that is. Let's fix that, because you'll meet it again.

"Think of it like the manager's settings on your shop's billing software," Ethan said. "Your staff see the normal screen. But there's a manager login with switches your staff can't reach — discount limits, refund permissions, that sort of thing."

Group Policy Editor is the manager's panel for Windows itself.

The Settings app you use every day shows you the friendly switches. Group Policy Editor shows you roughly three thousand switches underneath — the ones Microsoft built for company IT departments to control hundreds of office computers at once.

It is a real, official, built-in Microsoft tool. It is not a hack, and it is not third-party software. You open it by typing gpedit.msc.

Why "msc"?

It stands for Microsoft Saved Console. Windows has a handful of these admin tools and they all end in .msc — you'll see services.msc and devmgmt.msc later in this guide. When a tutorial tells you to type something ending in .msc, it's opening one of these built-in admin panels.

How to check which edition you have

1. Press Windows + R. (This opens the Run box — a small text box for launching things by name. It's the fastest way into every tool in this guide.)
2. Type winver and press Enter.
3. A small window shows your Windows version and edition.

Note down whether it says Home or Pro. It decides which methods below will work for you.

Which Method Should You Use?

"Six methods sounds like a lot," Jake said.

"It's six because your situation isn't everyone's situation," Ethan replied. "Here's the whole thing on one page."

"Honestly Jake, for your shop? Method 3 plus Method 2 on Saturdays. You'd never have lost that sale, and you'd still be patched."

Method 1: Set Your Connection as Metered (Easiest, Works on Home)

Windows assumes a metered connection means you're paying per gigabyte — a mobile hotspot, for instance. So it stops downloading large updates on its own.

You're not lying to Windows so much as telling it "treat this connection as expensive."

On Wi-Fi (Windows 11)

1. Settings (Windows + I) → Network & internet.
2. Click Wi-Fi, then click your network's name.
3. Turn Metered connection on.

On Wi-Fi (Windows 10)

1. Settings → Network & Internet → Wi-Fi.
2. Click your connected network name.
3. Turn Set as metered connection on.

On a cable (Ethernet)

Same path, but click Ethernet instead of Wi-Fi, then your connection name. Older Windows 10 builds didn't offer this for Ethernet — if the switch isn't there, use Method 4 or 5.

What it won't stop: Microsoft still pushes updates it considers critical over a metered connection. That's deliberate, and on balance a good thing.

Method 2: Pause Updates (Official, Reversible, Safe)

Built for exactly Jake's situation — "not this week."

1. Settings → Windows Update. (Windows 10: Settings → Update & Security → Windows Update.)
2. Find Pause updates.
3. Choose a duration — one week at a time, up to five weeks total.

After the maximum pause, Windows makes you install what's waiting before you can pause again. That's intentional: it stops a machine drifting a year out of date.

"This is the one I'd use before a busy weekend," Ethan said. "Pause on Friday, let it install Monday morning before you open."

Method 3: Active Hours (The One Most People Actually Need)

Here's the thing Jake didn't know: Windows was never going to restart during his Active Hours. His were set to the default 8am–5pm. His shop is open until 9pm.

The update didn't ambush him. His Active Hours were just wrong.

1. Settings → Windows Update → Advanced options.
2. Click Active hours.
3. Switch from Automatically to Manually.
4. Set your real hours — Jake set 8am to 10pm.

You get up to an 18-hour window. Windows will still download and install in the background, but it will not force a restart inside those hours.

Method 4: Group Policy Editor (Windows Pro)

Now that you know what it is, here's how to use it.

Opening it

1. Press Windows + R.
2. Type gpedit.msc and press Enter.
3. A window opens with a folder tree on the left.

Getting "Windows cannot find gpedit.msc"? You're on Home edition. Skip to Method 5.

Finding the setting

Expand the left-hand tree in this order:

Computer Configuration
  └── Administrative Templates
        └── Windows Components
              └── Windows Update
                    └── Manage end user experience   (Windows 11 only)
                          └── Configure Automatic Updates

On Windows 10 and older Windows 11 builds, Configure Automatic Updates sits directly under Windows Update — there's no "Manage end user experience" folder. If you don't see it, look one level up.

Setting it

1. Double-click Configure Automatic Updates.
2. Top-left, choose Enabled.
   (Counter-intuitive, but correct: you're enabling the policy so you can control the behaviour. Choosing "Disabled" here hands control back to Windows.)
3. Under Options, pick from the dropdown:

• 2 – Notify for download and auto install — the one to pick. Windows tells you an update exists and waits. Nothing downloads or installs until you say so.
• 3 – Auto download and notify for install — downloads quietly, asks before installing. Good if your connection is slow but you don't want surprise restarts.
• 4 – Auto download and schedule the install — lets you pin installs to, say, 4am Sunday.
• 5 – Allow local admin to choose setting — rarely useful at home.

4. Click Apply, then OK.
5. Restart, or force it immediately: press Windows + R, type cmd, press Enter, then type gpupdate /force and press Enter.

Undoing it

Same screen, set it back to Not Configured, Apply, OK, restart.

Method 5: The Registry (Home Edition's Equivalent)

"What's the Registry?" Jake asked.

"Windows' master settings file," Ethan said. "Every setting on the machine lives there. Group Policy Editor is really just a friendly front-end that writes to it. No Group Policy on Home? Write the same values yourself."

"That sounds like something I could break."

"It is. So we back it up first — that's step one, not optional."

Back up the Registry first

1. Windows + R → type regedit → Enter → click Yes.
2. In the menu: File → Export.
3. Under Export range choose All.
4. Save it somewhere you'll find again. If anything goes wrong, double-click that file to restore.

Make the change

1. In Registry Editor, paste this into the address bar at the top and press Enter:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

2. Look for a key (folder) called WindowsUpdate. If it isn't there: right-click Windows → New → Key → name it WindowsUpdate.
3. Right-click WindowsUpdate → New → Key → name it AU.
4. Click AU. In the empty right-hand pane, right-click → New → DWORD (32-bit) Value.
5. Name it AUOptions.
6. Double-click it and set Value data to 2.
   (Same numbering as Group Policy: 2 = notify before downloading.)
7. Close Registry Editor and restart.

To stop updates entirely instead, create a DWORD called NoAutoUpdate and set it to 1. Read the warning below before you do.

Method 6: Disabling the Windows Update Service (Last Resort)

This is the method most old articles recommend. Ethan's view: it's the worst of the six.

1. Windows + R → services.msc → Enter.
2. Scroll to Windows Update in the list.
3. Double-click it.
4. Set Startup type to Disabled.
5. Click Stop, then Apply, then OK.
6. Go to the Recovery tab and set all three failure dropdowns to Take No Action.

That last step matters. Without it Windows detects the stopped service and restarts it, often within a day — which is why people say "I disabled it and it turned itself back on."

Why it's a last resort: it blocks everything, including security patches. It also breaks the Microsoft Store, Defender definition updates, and sometimes driver installs, in ways that are genuinely hard to trace back to this change six months later.

If You're Still on Windows 10, Read This Before You Block Anything

"One more thing," Ethan said. "What version is that billing PC on?"

"Windows 10. It's from 2019."

"Then this matters more for you than for most people."

Windows 10 reached end of support on 14 October 2025. It still runs, but Microsoft no longer ships free security updates for it. Every vulnerability found since then stays open.

Microsoft offers a consumer Extended Security Updates (ESU) programme that continues security patches through 13 October 2026 — a bridge, not a solution.

So if you're on Windows 10 and blocking updates: you're blocking a supply that has mostly stopped anyway. The real question isn't how to stop updates — it's what happens after October 2026.

Your three options

• Upgrade to Windows 11 free. If the PC meets the requirements — 8th-gen Intel or Ryzen 2000 and newer, TPM 2.0, Secure Boot — it's a free upgrade. Check with the PC Health Check app.
• Enrol in consumer ESU. Buys you until October 2026. Fine as a stopgap for a machine you're planning to replace anyway.
• Replace the machine. For a PC that handles customer payment records, a 2019 machine with no security updates is a real liability, not a theoretical one. Any current laptop or desktop ships with Windows 11 and gets patched.

"For a billing PC with customer data on it," Ethan said, "I'd budget for a replacement rather than run unpatched. Pair it with proper antivirus and a cloud backup and you've removed three problems at once."

Troubleshooting: When It Doesn't Stick

"Some settings are managed by your organization"

You'll see this after using Group Policy or the Registry. On a personal PC it's harmless — Windows just means "a policy is set here", and you're the one who set it. To clear it, reverse the change and run gpupdate /force.

Updates install anyway

Check in this order: is it a critical update (those bypass metered connections)? Did your five-week pause expire? Did a feature update reset the policy — they sometimes do? Re-apply and restart.

The service re-enables itself

You skipped the Recovery tab in Method 6. Set all three dropdowns to Take No Action.

gpedit.msc not found

Home edition. Use Method 5. You'll find third-party installers that claim to add gpedit to Home — they work inconsistently and can break future updates. The Registry method does the same job using tools already on your PC.

Updates keep failing with an error code

Different problem entirely — that's a broken update component, not automatic updating. Run the built-in troubleshooter: Settings → System → Troubleshoot → Other troubleshooters → Windows Update → Run.

What Jake Actually Did

Not the dramatic option.

1. Active Hours set to 8am–10pm, matching his shop.
2. Pause updates every Friday evening, released Monday morning.
3. Cloud backup on the invoice folder — the part he'd been putting off.
4. A quote for a Windows 11 machine, because the 2019 PC is out of support and holds customer data.

Security patches still arrive. Nothing restarts during trading hours. Total time: about ten minutes.

"That's it?" Jake said. "I thought I'd need the Registry thing."

"Most people don't. They just get told they do."

---

What Actually Happens If You Block Updates Too Long

Every guide tells you how to stop updates. Almost none tell you what the bill looks like when it arrives. Here it is, in the order it happens.

Weeks 1–4: nothing. This is the trap.

Everything works. Nothing nags you. This is precisely why people leave updates off for years — there is no feedback signal telling you the risk is accumulating.

Months 2–6: the security gap opens

Patch Tuesday fixes are published every month, and the details become public when they ship. That is the uncomfortable part — a patch is also an announcement of exactly what was broken. Attackers read them. An unpatched machine is not merely "not updated"; it is running a documented, publicly known weakness.

On a machine holding customer records or doing online banking, this is the point at which the trade stops being reasonable.

Months 6–12: things quietly stop working

Modern applications assume a reasonably current Windows. Over time you will see:

• Browsers refusing to update, which is its own security problem
• New apps declining to install, citing a minimum Windows version
• Banking and government sites failing on outdated TLS support
• Printer and graphics drivers with no working version for your build

Beyond 12 months: the forced update

Each Windows version has a support end date of its own. When your specific build reaches it, Windows stops honouring your deferral settings and installs a feature update anyway — often at the worst possible moment, because you were not expecting it.

The irony is exact: people who block updates hardest tend to get the biggest, most disruptive forced update, because a year of skipped changes arrives in one go. Jake's twenty-five minute interruption becomes a two-hour one.

Two Settings Worth Changing While You're In There

Delivery Optimization — stop uploading updates to strangers

Windows shares downloaded updates with other PCs, peer-to-peer, to reduce load on Microsoft's servers. On an unlimited office connection that is harmless. On a metered or slow connection — or a shop where the same line runs the card machine — it eats bandwidth you are paying for.

Settings → Windows Update → Advanced options → Delivery Optimization → turn off Allow downloads from other PCs, or restrict it to your local network only.

Almost nobody knows this is on. It is on by default.

Turn off "Get me up to date"

Newer Windows 11 builds include a setting that lets Windows restart outside your Active Hours to finish an update it considers overdue. If you have carefully configured Active Hours and updates still restart your machine, this is usually why.

Same screen: Windows Update → Advanced options. Turn it off if you need Active Hours respected absolutely.

Frequently Asked Questions

Can I permanently disable Windows Update?

Yes, via Group Policy or the Registry — but it leaves your PC without security patches. Setting updates to notify before download (option 2) gives you complete control over timing while keeping you protected. That's what you actually want in almost every case.

Does Windows 10 Home have Group Policy Editor?

No. gpedit.msc ships only with Pro, Enterprise, and Education. Home users should use a metered connection or the Registry method.

How do I stop Windows restarting while I'm working?

Set Active Hours: Settings → Windows Update → Advanced options → Active hours. Switch to Manually and set your real working hours, up to an 18-hour window.

Is it safe to stop updates on Windows 10 now?

Riskier than it used to be. Windows 10 lost free security support on 14 October 2025. If you're still on it, blocking the few updates you can still get isn't advisable unless you've enrolled in Extended Security Updates.

Will disabling updates make my PC faster?

Only while an update is actively downloading or installing. Once it's done, a patched PC runs identically to an unpatched one. If yours is slow all the time, that's a different problem — usually startup programs, a full disk, or a mechanical hard drive that should be an SSD.

What's the difference between pausing and disabling?

Pausing is official, temporary (five weeks maximum), and reverses itself. Disabling is permanent until you undo it, and blocks security patches. Pause for a busy week; disable only if you have a specific reason and understand the trade-off.

---

How long can I safely pause updates?

Windows lets you pause for up to 5 weeks in one go. That is a reasonable outer limit for a machine you rely on. Beyond a few months you start collecting the problems described above — unpatched vulnerabilities first, then apps and drivers refusing to work.

Does a metered connection block security updates too?

It blocks most automatic downloads, but Windows still delivers updates it classes as critical. It is a brake, not a switch — which is exactly why it is a safer choice than disabling the service.

Why does Windows still restart during my Active Hours?

Three usual causes: Active Hours is limited to an 18-hour window so 6 hours are always fair game; a newer Windows 11 setting allows restarts outside them to finish overdue updates (turn it off under Advanced options); or the restart came from something other than Windows Update, such as a driver installer or a crash.

Can I stop updates on Windows 11 Home without Group Policy?

Yes. Home has no Group Policy Editor, but the metered connection method, Pause updates and Active Hours all work on Home — and together they cover what most people actually want. The Registry method also works on Home if you need something more permanent.

Is Windows Update using all my internet?

Possibly, and not only for your own downloads — Delivery Optimization shares your downloaded updates with other PCs over the internet by default. Turn it off under Windows Update → Advanced options → Delivery Optimization, or limit it to your local network.

Will blocking updates stop the Windows 11 upgrade prompt?

The nag to upgrade is delivered separately from ordinary updates, so deferrals do not reliably silence it. If your PC is eligible and you do not want it yet, the cleanest approach is to check whether your PC actually meets the Windows 11 requirements and make a deliberate decision, rather than deferring indefinitely on a version that is now past end of support.

My update keeps failing and retrying. How do I stop the loop?

A failed update that retries forever is usually a corrupted download rather than a settings problem. Open an elevated Command Prompt (run as administrator) and try DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow. If that does not clear it, clearing the update cache in C:\Windows\SoftwareDistribution\Download after stopping the Windows Update service usually does.

What happens if I block Windows updates for a year or more?

You accumulate publicly documented security vulnerabilities first, then applications and drivers start refusing to install because they require a newer build, and eventually Windows overrides your deferral settings and installs a large feature update anyway once your specific version reaches its own end of support. That forced update is usually far more disruptive than the ones you avoided — a year of skipped changes arriving in one go.

Coming Up Next

Jake's PC is patched on his schedule now, but it's still slow to start. Next time, Ethan shows him what's actually running at boot — and why half of it doesn't need to be.

More in this series

• How to check if your PC can run Windows 11
• Windows 10 end of support: what happens to your PC now
• How to delete the Windows.old folder and reclaim 20–40 GB
• Why your PC takes five minutes to start, and how to fix it

Related Guides