Time (in seconds) to force reboot when required for policy changes to take effect
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2008 R2 or Windows 7
Path in the GPO console
Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions Description
This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot. If you disable or do not configure this policy setting, the system does not force a reboot. Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted.
Registry
HKLM
Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions Value name: ForceReboot
Enabled: ForceReboot = 1
Disabled: ForceReboot = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Time (in seconds) to force reboot when required for policy changes to take effect
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions]
"ForceReboot"=dword:00000001
"RebootTime"=dword:00000078More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ForceReboot' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RebootTime' -Value 120 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime
Data type: String
Value:
<enabled/>
<data id="DeviceInstall_Policy_RebootTime_Time" value="120"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions' -Name 'ForceReboot' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions' -Name 'RebootTime' -Expected 120 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ForceReboot' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RebootTime' -Value 120 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions' -Name 'ForceReboot' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions' -Name 'RebootTime' -Expected 120 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Time (in seconds) to force reboot when required for policy changes to take effect
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ForceReboot' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RebootTime' -Value 120 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.