Control Optional Windows Updates with Group Policy

Optional Windows Updates fly under the radar on many Home systems. They come as different types. The most common is the monthly non-security preview update for Windows 10 and Windows 11.

There are other optional updates, e.g., bug fixes, other non-security updates and also improvements.

Up until recently, administrators had to search for optional updates manually on Windows to install them. This changed with the introduction of a new setting in Windows Updates.

Administrators who open Settings > Windows Update on Windows 11 see the “Get updates as soon as they’re available” option there. The same option is also available on Windows 10.

Microsoft explains on this Help page that the setting allows users to get “the latest non-security and feature updates as soon as they become available”. The caveat; Microsoft says that this only applies if the update becomes available for the device.

In other words: while it ensures that the update is installed when it becomes available, it still leaves it to Microsoft when that happens.

The following happens when the functionality is enabled in Settings. The device “will be among the first to get the latest non-security updates, fixes, improvements, and enhancements” says Microsoft. The setting does not affect security updates, which will still be pushed to devices, even if set to Off.

The “check for updates” button of Windows Updates also downloads and installs the most recent updates for the device.

The Group Policy gives administrators more control over the functionality.

Optional Windows Updates Group Policy configuration

Administrators may use the Enable Optional Updates policy to control the installation of these updates on managed devices.

1. Open the Start Menu, type gpedit.msc and select the Edit Group Policy from the results. This launches the program.
2. Navigate to Local Computer Policy > Computer Configuration > Administrative Templates >B Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates.
3. Set the policy to Enabled to configure the delivery of optional options. Set it to Disabled to turn off the optional updates delivery on the device.

A menu lists the three configuration options when Enabled is selected.

• Automatically receive optional updates (including CFRs) — This installs the latest optional updates on the device. It includes Controlled Feature Rollouts and optional cumulative updates.
• Automatically receive optional updates — Same as above, but without Controlled Feature Rollouts.
• User scan select which optional updates to receive — The user is in control via Windows Updates in Settings.

Notes on optional updates and their delivery

At least some optional updates need to be considered beta. This is true for the optional non-security updates that Microsoft releases about two weeks before their inclusion in the regular cumulative updates for the operating system.

Most Windows users may want to skip the installation of optional updates, especially on production machines.

It is also a good idea to create backups regularly, not Windows Backup though, as it doesn’t include all data. Windows includes some restoration functionality, but it has failed for some users in the past.

Closing Words

Administrators may want to disable Optional Windows Updates on most managed devices to limit potential issues that could arise from the installation. Home users may also want to block these for the most part. There is still the option to activate the “check for updates” button, if you read about a new update that you want to install.

Now You: how do you handle optional updates?