Configure automatic updates for Windows Update on Windows instances

Alibaba Cloud WSUS update servers

By default, the group policy for Alibaba Cloud Windows instances sets the update source to Alibaba Cloud's internal Windows Server Update Services (WSUS) servers, not Microsoft's official Internet Windows Update servers. This is because, in rare cases, security updates can cause potential issues. To prevent such issues, we review the Windows security updates that we receive from Microsoft. We then publish the approved updates to our internal WSUS servers.

Because this group policy is configured, the following message appears on the Change settings page.

We modified three group policies related to Windows Update:

• Configure automatic updates

• Specify intranet Microsoft update service location

• Allow Automatic Updates to install immediately

To view and verify the Windows Update group policy, follow these steps:

1. Open Run.

2. Enter gpedit.msc.

3. In the Local Group Policy Editor, navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update.

   Note

   After you modify any of the highlighted group policies, open the command prompt (CMD) as an administrator. Then, run the gpupdate /force command to apply the changes.

   

Configure automatic updates

Double-click Configure Automatic Updates. The default options are Enabled and 2 - Notify for download and notify for install. When this option is selected, you are notified about updates. You can then manually install the updates that you need.

Change the configuration as follows:

• To manage updates manually, set the policy to 5 - Allow local admin to choose setting or Not Configured.

• If you select Disabled, you must download and manually install any available updates from Windows Update.

Specify intranet Microsoft update service location

Double-click Specify intranet Microsoft update service location. The default option is Enabled.

When this option is enabled, you can set the update server and the statistics server. After you configure the settings, use the telnet command to test the connection. If you can access port 80 on the server, it indicates that the instance is connected to the update server.

• For ECS instances in the classic network, the default servers are:

  • Update server: http://windowsupdate.aliyun-inc.com

  • Statistics server: http://windowsupdate.aliyun-inc.com

• For ECS instances in a VPC, the default servers are:

  • Update server: http://update.cloud.aliyuncs.com

  • Statistics server: http://update.cloud.aliyuncs.com

Allow Automatic Updates to install immediately

Double-click Allow Automatic Updates to install immediately. The default option is Disabled. When this option is selected, the system does not automatically install updates. Select Enabled to allow automatic installation.

Switch to Microsoft's official Internet Windows Update servers

We review all Windows security updates before we publish them. This process means that updates from our internal WSUS servers may be delayed compared to those from Microsoft's official servers. If this delay is not acceptable, you can use one of the following methods to switch to Microsoft's official Internet Windows Update servers:

• Modify the group policy configuration

• Modify the registry configuration

Modify the group policy configuration

1. Open Run.

2. Enter gpedit.msc.

3. In the Local Group Policy Editor, navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update.

4. Double-click Specify intranet Microsoft update service location and change the setting to Not Configured.

5. Open the command prompt (CMD) as an administrator and run the gpupdate /force command to apply the changes.

Modify the registry configuration

This section uses Windows Server 2012 as an example to show how to modify the registry to use Microsoft's official Internet Windows Update servers.

1. Open Run.

2. Enter regedit to open the Registry Editor.

3. First, back up the registry information for the WindowsUpdate folder:

   1. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate folder.

   2. From the menu, click File > Export.

   3. In the export file dialog box, select a file path, enter a name for the exported file, such as "reg-backup", and click Save.

4. Modify the registry as follows:

   1. In the WindowsUpdate folder, click the AU folder.

   2. In the right pane, double-click the UseWUServer item. Change the Value data to 0 and click OK.

   3. In the right pane, double-click the AUOptions item. Change the Value data to 4 or 2, and click OK.

      Note

      If you set AUOptions to 4, updates are automatically downloaded and installed. The ECS instance might restart automatically to complete the update. To receive a notification before updates are installed, set AUOptions to 2, which is the default.

   4. For more information, see the official Microsoft documentation.

5. Open the Windows command prompt. Run the following commands to restart the WuAuServ service. After the service restarts, you can receive updates from the official Microsoft servers.

   net stop WuAuServ
   net start WuAuServ

   The output is similar to the following.