add article

Author: Deland-Han

support/windows-server/installing-updates-features-roles/unexpected-automatic-update-when-disabled-by-group-policy.md

@@ -0,0 +1,56 @@
+---
+title: Windows unexpectedly install updates when automatic updates are disabled by Group Policy
+description: Discusses a problem that  Windows unexpectedly install updates when automatic updates are disabled by Group Policy.
+audience: itpro
+manager: dcscontentpm
+ms.date: 04/01/2025
+ms.reviewer: 5x5dnd, shan
+ms.topic: troubleshooting
+ms.custom:
+- sap:windows servicing,updates and features on demand\windows update configuration,settings and management
+- pcy:WinComm Devices Deploy
+---
+# Windows unexpectedly install updates when automatic updates are disabled by Group Policy
+
+Windows unexpectedly install updates on Windows Server 2016 and Windows Server 2019 automatically even though the Group Policy **Configure Automatic Updates** is set to option 3 or option 4:
+
+- Option 3: **Download the updates automatically and notify when they are ready to be installed**
+- Option 4: **Automatically download updates and install them on the schedule specified below**
+
+## Cause
+
+This issue occurs when an administrator runs the command `GPUPDATE / FORCE`. This command resets all policy setting and reapplies them. During this time interval, automatic update settings are reverted to defaults and updates might be installed. This issue only occurs on Windows Server 2016 and Windows Server 2019.
+
+## Resolution
+
+To avoid this issue, do not run `GPUPDATE /FORCE` on Windows Server 2016 and 2019 unless you are prepared for any queued updates to be installed. This issue is rare, but it is possible to occur.
+
+## Workarounds for Windows Server 2016 and Windows Server 2019
+
+For users on Windows Server 2016 and Windows Server 2019, implementing one of the following workarounds can help reduce the frequency of the issue:
+
+### Enable the "Configure registry policy processing" policy
+
+1. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure registry policy processing** and set it to **Enabled**.
+2. Unselect **Do not apply during periodic background processing**.
+3. Select **Process even if the Group policy objects have not changed**.
+
+### Enable the "Configure registry policy processing" policy by using registry
+
+1. Set the following registry keys:
+
+   `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}`  
+   "NoBackgroundPolicy"=dword:00000000  
+   "NoGPOListChanges"=dword:00000001
+
+2. You can also runt he following command to modify the registry:
+
+   ```console
+   reg add "HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /v NoBackgroundPolicy /t REG\_DWORD /d 00000000 /f
+   reg add "HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /v NoGPOListChanges /t REG\_DWORD /d 00000001 /f
+   ```
+
+For more information, see [Configure registry policy processing (admx.help)](https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.GroupPolicy::CSE_Registry)
+
+> [!NOTE]
+> These workarounds reduce the frequency of the problem occurring but do not always prevent the issue.

support/windows-server/toc.yml

@@ -3035,6 +3035,8 @@ items:
       href: ./installing-updates-features-roles/block-user-access-windows-update.md
     - name: Re-register Windows client/server in WSUS
       href: ./installing-updates-features-roles/re-register-windows-clientserver-in-wsus.md
+    - name: Unexpected automatic update when it is disabled by Group Policy
+      href: installing-updates-features-roles/unexpected-automatic-update-when-disabled-by-group-policy.md
     - name: Why you may be prompted to restart your computer
       href: ./installing-updates-features-roles/why-prompted-restart-computer.md
     - name: WSUS 3.0 SP2 Dynamic Install for Server Manager