1

There are innumerable reasons why someone would not want Windows to automatically apply any and all updates blindly. Most rational people with a modicum of computer knowledge will opt to set Windows to automatically check for updates, but let them review the list before manually applying them.

The problem is that there are some updates that we may in fact want automatically applied such as Windows Defender/Security Essentials definitions. Most people will usually want to automatically update those.

The Windows Update configuration dialog seems to only let you turn everything on or off.

I don’t suppose that there is any way to configure updates per-item so that some things like malware definitions are automatically updated?

I fear there may be no way to do this for two reasons:

  • While the configuration dialog exposes a limited set of options, the registry settings don’t seem to offer any more flexibility.
  • Allowing this would require some sort of item-specific identifier to distinguish items which seems not to be the case per this question.
6
  • are you talking about one computer, or many?
    – Keltari
    Mar 7, 2014 at 18:26
  • I do believe its one of those even with running your own WSU server it would be one or the other.
    – Ramhound
    Mar 7, 2014 at 18:36
  • Even with WSUS it's done by category, but you CAN set it to auto-update any new revisions of updates you've previously approved. more directly to the Defneder updates: there's a WSUS category specifically for signature updates - we had to make a specific WSUS rule to get it to auto approve definitions along with other updated. Mar 7, 2014 at 18:57
  • in general: yah, such a feature would be very nice. windows-defender-signature-update: "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -UnmanagedUpdate (as admin)
    – akira
    Mar 10, 2014 at 13:33
  • mhh .. you can also tell defender to update it's signatures upon startup via group-policy-editor: "administrative templates" -> "windows components" -> "windows defender"
    – akira
    Mar 12, 2014 at 16:39

1 Answer 1

0

You can try to script updates on command line, on remote computers you can do that with psexec - there is a command line tool called wuinstall that can do that - gives you complete control over every update you install, you have to be a bit fit at shell scripting though.

If you check the documentation on the website (http://www.wuinstall.com), there are lot of options to select updates - simplest way would be to call

wuinstall /install /match "Internet Explorer" 

to only instal IE updates - you can also filter by product, KB-Numer or regex

1
  • Unfortunately it looks like we will indeed have to rely on third-party tools like this and a few others. I was hoping that Microsoft had enough sense to provide a built-in option, but of course that is just wishful thinking.
    – Synetech
    Apr 17, 2014 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .