Pre-Downloading Updates via Windows Update and Installing with Automox

Issue

You want Windows to download update files in the background so they are already staged locally, but you want Automox to decide when those updates install. Configured incorrectly, Windows installs on its own schedule and reboots outside your maintenance window.

Environment

• Automox (current agent release)
• Windows devices patched by an Automox Windows patch policy
• Local Administrator (to edit Group Policy or the registry)

Overview

Windows Update's Configure Automatic Updates setting has a "download but do not install" mode (AUOptions value 3). In this mode Windows fetches applicable update files into the local update cache in the background, but waits to install them. Automox then installs the already-downloaded files on your policy's schedule, so installation timing and reboots stay under Automox's control while download bandwidth is spent ahead of time.

The key is to pick option 3 (download and notify), not option 4 (download and schedule install) — option 4 hands installation timing back to Windows and defeats the purpose.

Resolution

1. Set Configure Automatic Updates to option 3 using either Group Policy or the registry (per Microsoft's Windows Update settings reference):
   • Group Policy: open the Group Policy Editor and go to Computer Configuration \ Administrative Templates \ Windows Components \ Windows Update \ Configure Automatic Updates. Set it to Enabled, then choose 3 - Auto download and notify for Install.
   • Registry: under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, set the DWORD values:
     • NoAutoUpdate = 0
     • AUOptions = 3
2. Confirm Automox owns installation:
   • Make sure a Windows Patch policy targets the device with the schedule you want. Automox installs the staged updates on that schedule.
   • Do not set AUOptions to 4 or configure a Windows "scheduled install" — that lets Windows install and reboot on its own.
3. (Optional) Suppress the end-user install prompt so users don't kick off installs manually:
   • In Group Policy, enable Computer Configuration \ Administrative Templates \ Windows Components \ Windows Update \ Remove access to use all Windows Update features. Background scans and downloads keep working; only the user-facing Check for updates / install controls are removed. See Microsoft's reference.

Notes

• Pre-downloading only stages the files; Automox still runs the install, so a patch policy (or manual patch action) is required for anything to install.
• These are policy-backed registry keys. A conflicting Group Policy or a Windows Update for Business configuration can override AUOptions — reconcile any existing update policy before relying on this.
• To audit what update policies are already in effect on a device, the community Windows - Data Collection & Auditing - Detect Windows Update Group Policies worklet (Automox Worklet Catalog; premium tier, no add-on license required) reports the GPO and registry settings that affect Windows Update behavior. Run it before this change if you suspect a conflicting policy.