Specify intranet Microsoft update service location
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service Description
Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them. If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. Note: If the "Alternate Download Server" is not set, it will use the intranet update service by default to download updates. Note: The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. Note: This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. To ensure the highest level of security, Microsoft recommends securing WSUS with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. If a proxy is required, we recommend configuring system proxy. To ensure highest levels of security, additionally leverage WSUS TLS certificate pinning on all devices. In order to keep clients inherently secure, we are no longer allowing intranet servers to leverage user proxy by default for detecting updates. If you need to leverage user proxy for detecting updates while using an intranet server despite the vulnerabilities it presents, you must configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails". Detection for updates against intranet servers will fail when user proxy is needed as a fallback and the alternate proxy behavior is not configured.
Registry
Software\Policies\Microsoft\Windows\WindowsUpdate This policy sets several registry values:
UseWUServer AU UseWUServer = 1 UseWUServer = 0 MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Update/AllowUpdateService Multiple CSP matches are possible; the first one was selected.
Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
CSP values
-
0- Not allowed. -
1 (Default)- Allowed.
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Specify intranet Microsoft update service location
; State: Enabled
; Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU]
"UseWUServer"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"=""
"WUStatusServer"=""
"UpdateServiceUrlAlternate"=""
"FillEmptyContentUrls"=dword:00000000
"DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection"=dword:00000000
"SetProxyBehaviorForUpdateDetection"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseWUServer' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WUServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'WUStatusServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'UpdateServiceUrlAlternate' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'FillEmptyContentUrls' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'SetProxyBehaviorForUpdateDetection' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Update/AllowUpdateService
Data type: String
Value:
<enabled/>
<data id="CorpWUURL_Name" value=""/>
<data id="CorpWUStatusURL_Name" value=""/>
<data id="CorpWUContentHost_Name" value=""/>
<data id="CorpWUFillEmptyContentUrls" value="0"/>
<data id="CorpWUDoNotEnforceEnterpriseTLSCertPinningForUpdateDetection" value="0"/>
<data id="SetProxyBehaviorForUpdateDetection" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'UseWUServer' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'WUServer' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'WUStatusServer' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'UpdateServiceUrlAlternate' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'FillEmptyContentUrls' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'SetProxyBehaviorForUpdateDetection' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseWUServer' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WUServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'WUStatusServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'UpdateServiceUrlAlternate' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'FillEmptyContentUrls' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'SetProxyBehaviorForUpdateDetection' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'UseWUServer' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'WUServer' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'WUStatusServer' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'UpdateServiceUrlAlternate' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'FillEmptyContentUrls' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'SetProxyBehaviorForUpdateDetection' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify intranet Microsoft update service location
# State: Enabled
# Supported on: At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseWUServer' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WUServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'WUStatusServer' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'UpdateServiceUrlAlternate' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'FillEmptyContentUrls' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'SetProxyBehaviorForUpdateDetection' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.