0) Confirm Your Windows Edition (matters)

Some of the strongest controls require Windows 11 Pro / Enterprise / Education. Windows 11 Home can still reduce
update behavior, but enforcement is weaker.

1. Settings → System → About
2. Under Windows specifications, find Edition

Layer 1 — Standard Windows Update Settings (do these first)

1) Pause Updates (immediate protection)

This is the fastest short-term protection. It is not permanent, but it prevents surprise installs right now.

Settings → Windows Update → Pause updates

2) Active Hours (reduce restart risk)

Set Active hours to cover when you’re typically working. Use Manually if available.

Settings → Windows Update → Advanced options → Active hours

• Set to Manually and choose a wide window (e.g., 6:00 AM to 2:00 AM), within allowed limits.

3) Restart Notifications (must-enable)

Ensure Windows must notify you before a restart is required to finish updating (wording varies by build).

Settings → Windows Update → Advanced options

• Enable: Notify me when a restart is required to finish updating (or equivalent)
• Disable (if present): Restart this device as soon as possible when required

Layer 2 — Metered Connection (very effective on Home)

Setting your network as Metered can block most automatic update downloading.

Settings → Network & Internet

• Wi‑Fi → your network → Metered connection → On
• Ethernet → Metered connection → On

Layer 3 — Power & Startup Behavior (reduces odd reboot patterns)

4) Disable Fast Startup

Fast Startup can cause shutdown/restart behavior that feels inconsistent, especially around staged updates.

1. Control Panel → Power Options
2. Choose what the power buttons do
3. Click Change settings that are currently unavailable
4. Uncheck Turn on fast startup (recommended)

Layer 4 — Group Policy (best long-term control) (Pro/Enterprise/Edu)

5) Prevent Auto-Restart When Logged In

This is the most important policy for preventing surprise reboots while you’re using the machine.

Win + R → gpedit.msc

Path (typical):

Computer Configuration → Administrative Templates → Windows Components → Windows Update

(On some builds: Windows Update → Manage end user experience)

• Enable: No auto-restart with logged on users for scheduled automatic updates installations

6) Switch Updates to “Notify” (not automatic)

This changes behavior from “download/install when Windows decides” to “prompt first”.

• Enable: Configure Automatic Updates
• Set option: 2 — Notify for download and auto install

7) Prevent Updates from Waking the PC

Stops Windows Update power management from waking the system to apply updates.

• Set to Disabled: Enabling Windows Update Power Management to automatically wake up the system

Layer 5 — Advanced Hardening (use with care)

These steps can reduce reboot automation further, but Windows feature updates may revert them. Apply policy controls first.

8) Task Scheduler: UpdateOrchestrator Tasks

Some reboot/scheduling behavior is driven by tasks under UpdateOrchestrator.

1. Open Task Scheduler
2. Navigate: Task Scheduler Library → Microsoft → Windows → UpdateOrchestrator
3. Review tasks like: Reboot, Reboot_AC, Reboot_Battery, Schedule Scan, USO_UxBroker
4. Disable only what you understand; Windows may re-enable these later.

9) Services (understand before disabling)

Disabling update services can break Store apps and cause update failures. Prefer Group Policy and metered connections first.

Win + R → services.msc

• Windows Update (wuauserv)
• Update Orchestrator Service (UsoSvc)
• Windows Update Medic Service (WaaSMedicSvc) — commonly re-enables update components

Recommended “No Surprise Reboot” Baseline

For most admins and power users, this is the best balance between staying secure and maintaining control:

1. Set Active hours wide and enable restart notifications.
2. Use Pause updates during critical work windows.
3. On Pro+: enforce Group Policy: No auto-restart while logged on + Notify for download/install.
4. Optionally enable Metered connection for an extra layer of download control.